fix(agent,engine,web): keep the due time as the deadline stamp; draw timeout verdicts hollow in the Network Timeline (D-238 revised)

Revises 14b185db after the pre-release review. The fleet measurement (30 days,
all tenants) showed 87 of 821 sessions with a sleep episode had their verdict
inside the episode — 59 of them one tenant's self-deploying devices closed two
minutes before the device-only detection came due and reopened 5–7 days later.
Stamping the firing clock would have turned those outages into session
duration and pushed the tenant's mean duration from minutes to days.

- OnDeadlineFired posts OccurredAtUtc = DueAtUtc again; the due time stays in the
  payload and the two stale-fire guards keep reading it (any stamp stays safe).
- Network Timeline: a timeout verdict (helloOutcome timeout, device-only detection
  window) is drawn as a hollow marker "Completed (timeout)" with a legend line and a
  plain-language tooltip — a wait expired, nothing observed on the device; the
  Asleep block is never split at it. finalizing_grace alone is not an indicator.
- Session Info standby note clips to the two WhiteGlove spans when the card shows
  the combined WhiteGlove duration; the dedup key is consumed only by a usable
  observation (review findings).
- Stale comments describing the firing-clock contract corrected.

Tests: DeadlineFireTimeStampTests (reducer stays correct for any stamp),
EnrollmentOrchestratorTests (due-time stamp + payload), networkTimelineModel
timeout markers (3), standby windows, WhiteGlove windows.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.github/dependabot.yml

@@ -55,6 +55,10 @@ updates:
       - dependency-name: '*'
         update-types: ['version-update:semver-major']
 
+  # Every action is referenced by commit SHA with the version in a trailing comment;
+  # action-pins.yml fails any workflow change that reintroduces a mutable tag. Dependabot
+  # is what keeps those pins current: it rewrites the SHA and the comment together, so the
+  # pins are reviewed in a PR instead of drifting silently or being bumped by hand.
   - package-ecosystem: github-actions
     directory: /
     schedule:

.github/scripts/Get-StorageAuthHeaders.ps1

@@ -0,0 +1,51 @@
+<#
+.SYNOPSIS
+    Returns the request headers that authorize an Azure Storage REST call with Microsoft Entra.
+
+.DESCRIPTION
+    One place for the storage OAuth contract shared by every publisher in this repo -- the
+    agent ZIP and MSI, the customer bootstrap scripts, the version manifests and the build
+    counters. Resource id, the az invocation, the service version and the failure message
+    live here so they cannot drift between call sites.
+
+    Identity comes from whatever `az login` established: the federated GitHub OIDC principal
+    in CI (azure/login, subject repo:okieselbach/AutopilotMonitor:ref:refs/heads/main), the
+    operator's own account for the local build. No secret is read, stored or passed around.
+
+    x-ms-version is MANDATORY here, not decoration: Entra-authorized requests are rejected
+    below 2017-11-09, and Table requests without a SAS must carry the header at all. 2021-08-06
+    is old enough to be deployed in every region and new enough for everything we send.
+
+    Callers merge the result into their own headers -- `$auth + @{ ... }` yields a new
+    hashtable per request, so nothing is shared across uploads:
+
+        $auth = & "$PSScriptRoot/Get-StorageAuthHeaders.ps1"
+        Invoke-RestMethod -Uri $url -Method Put -Headers ($auth + @{ 'x-ms-blob-type' = 'BlockBlob' }) -Body $bytes
+
+    Acquire once per step and reuse: every call shells out to az (~1s) and the token is valid
+    for the lifetime of a job.
+
+.OUTPUTS
+    [hashtable] Authorization + x-ms-version.
+#>
+[CmdletBinding()]
+param()
+
+$ErrorActionPreference = 'Stop'
+
+# The data-plane resource, not management.azure.com -- a management token is accepted by
+# neither the blob nor the table endpoint.
+$token = az account get-access-token --resource https://storage.azure.com --query accessToken -o tsv 2>$null
+
+if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($token)) {
+    throw ('Could not acquire an Azure Storage token. In CI this means the azure/login step ' +
+           'is missing or its federated credential does not cover this ref; locally, run ' +
+           '`az login`. A token alone is not enough: the principal also needs Storage Blob ' +
+           'Data Contributor on the container it writes, and Storage Table Data Contributor ' +
+           'on the table -- a missing role shows up later as HTTP 403 AuthorizationPermissionMismatch.')
+}
+
+return @{
+    'Authorization' = "Bearer $token"
+    'x-ms-version'  = '2021-08-06'
+}

.github/scripts/Publish-BootstrapScripts.ps1

@@ -12,52 +12,78 @@
                                 lands a consistent set (ZIP + manifest + scripts).
 
     Both callers run the same code. The scripts on the download alias are the live
-    copy the WDP bootstrap MSI (Invoke-BootstrapDownload.ps1) downloads on every
-    enrolling device, so "current" is a correctness property, not cosmetics.
+    copy the stage-1 loader downloads on every enrolling device, whether it came from
+    Intune or from the bootstrap MSI, so "current" is a correctness property, not
+    cosmetics.
 
     Steps, in order:
-      1. Parse $ScriptVersion from the bootstrap source.
-      2. Render the -Dev variant by literal substitution of the two URL/manifest
+      1. Parse $ScriptVersion from the loader and the bootstrap source.
+      2. Render the -Dev variants by literal substitution of the URL/manifest
          defaults. A missing anchor is a hard failure -- a silently un-substituted
          dev script would point the dev fleet at the stable agent.
-      3. Version-bump guard: if the published bootstrap differs from the source
-         but carries the same $ScriptVersion, abort. Otherwise the docs badge,
+      3. Version-bump guard: if a published script differs from its source but
+         carries the same $ScriptVersion, abort. Otherwise the docs badge,
          version.json.bootstrapVersion and the portal's "your script is outdated"
          hint would all keep asserting a version that is no longer what ships.
-      4. Upload every script blob with Cache-Control: no-cache (they rotate in
+      4. Build the publish set (loader, bootstrap, both dev renders, the extras).
+      5. Authenticode-sign every script (see -SigningToken). Signing is the LAST
+         transformation: it covers the exact CRLF/UTF-8 bytes that get uploaded,
+         and nothing may touch them afterwards or the signature breaks.
+      6. Upload every script blob with Cache-Control: no-cache (they rotate in
          place), mirrored fail-soft to the legacy account.
-      5. Reconcile the two version oracles: version.json.bootstrapVersion
-         (read-modify-write under If-Match, so a concurrent agent release cannot
-         lose its agent fields) and AdminConfiguration.LatestBootstrapV2ScriptVersion.
-      6. Verify through the alias -- re-download each blob and compare SHA-256.
+      7. Reconcile the version oracles: version.json.bootstrapVersion and
+         .loaderVersion (read-modify-write under If-Match, so a concurrent agent
+         release cannot lose its agent fields) and
+         AdminConfiguration.LatestBootstrapV2ScriptVersion.
+      8. Verify through the alias -- re-download each blob and compare SHA-256.
 
-.PARAMETER SasToken
-    Container SAS for the eu storage account with write permission. Leading '?' tolerated.
+    Comparisons against a published script always strip its signature block first
+    (Get-ComparableText). A signature carries a timestamp, so signed bytes differ on
+    every run; without stripping, the bump guard and the drift check would report a
+    change for every unchanged script.
 
 .PARAMETER LegacySasToken
     Container SAS for the legacy account. Optional -- a mirror failure warns, never fails.
-
-.PARAMETER TableSasToken
-    Table SAS for AdminConfiguration. Optional -- omitted or 'XXX' skips the oracle update.
+    The legacy account lives in a different tenant, so the ambient Entra identity cannot
+    reach it; this is the only credential the publisher still takes.
 
 .PARAMETER RepoRoot
     Repository root. Defaults to the parent of .github/scripts.
 
 .PARAMETER DryRun
-    Run every check and render, upload nothing.
+    Run every check and render, upload nothing. A dry run signs when a token is supplied
+    and skips signing when it is not: the PR gate runs this without any Azure login.
+
+.PARAMETER SigningToken
+    Azure Key Vault access token for AzureSignTool. MANDATORY for a real publish -- an
+    unsigned customer script is not something this repo publishes. Together with
+    -KeyVaultUrl and -CertificateName.
+
+.PARAMETER ExpectedPublisher
+    Optional -like pattern the signer subject must match after signing. Pins the publisher
+    instead of accepting any trusted signature; the loader on the device pins the same way.
+
+.PARAMETER SignedOutputDir
+    Optional directory that receives a copy of every published file exactly as uploaded.
+    Used by CI to offer the signed scripts as a build artifact for local inspection.
 
 .EXAMPLE
     ./Publish-BootstrapScripts.ps1 -DryRun
 
 .EXAMPLE
-    ./Publish-BootstrapScripts.ps1 -SasToken $env:SAS -TableSasToken $env:TABLE_SAS
+    ./Publish-BootstrapScripts.ps1 -LegacySasToken $env:LEGACY_SAS -SigningToken $env:AKV_TOKEN `
+        -KeyVaultUrl $env:KV_URL -CertificateName $env:CERT
 #>
 [CmdletBinding()]
 param(
-    [string]$SasToken,
     [string]$LegacySasToken,
-    [string]$TableSasToken,
     [string]$RepoRoot,
+    [string]$SigningToken,
+    [string]$KeyVaultUrl,
+    [string]$CertificateName,
+    [string]$TimestampUrl = 'http://timestamp.acs.microsoft.com',
+    [string]$ExpectedPublisher,
+    [string]$SignedOutputDir,
     [switch]$DryRun
 )
 
@@ -66,9 +92,6 @@ $ErrorActionPreference = 'Stop'
 if (-not $RepoRoot) {
     $RepoRoot = (Resolve-Path (Join-Path $PSScriptRoot '../..')).Path
 }
-if (-not $DryRun -and [string]::IsNullOrWhiteSpace($SasToken)) {
-    throw 'SasToken is required unless -DryRun is used.'
-}
 
 $ContainerUrl       = 'https://autopilotmonitoreu.blob.core.windows.net/agent'
 $LegacyContainerUrl = 'https://autopilotmonitor.blob.core.windows.net/agent'
@@ -78,8 +101,23 @@ $TableUrl           = "https://autopilotmonitoreu.table.core.windows.net/AdminCo
 $BootstrapSource   = Join-Path $RepoRoot 'scripts/Bootstrap/Install-AutopilotMonitor.ps1'
 $BootstrapBlob     = 'Install-AutopilotMonitor.ps1'
 $DevBlob           = 'Install-AutopilotMonitor-Dev.ps1'
+# Stage 1. Assigned in Intune once, and embedded in the bootstrap MSI; it downloads the
+# bootstrap above on every device and verifies its publisher before running it.
+$LoaderSource      = Join-Path $RepoRoot 'scripts/Bootstrap/Start-AutopilotMonitor.ps1'
+$LoaderBlob        = 'Start-AutopilotMonitor.ps1'
+$LoaderDevBlob     = 'Start-AutopilotMonitor-Dev.ps1'
 $ScriptContentType = 'text/plain; charset=utf-8'
 
+$SigningEnabled = -not [string]::IsNullOrWhiteSpace($SigningToken)
+if (-not $DryRun -and -not $SigningEnabled) {
+    throw ('Publishing requires -SigningToken (plus -KeyVaultUrl and -CertificateName): the ' +
+           'loader on every device verifies the publisher of what it downloads, so an unsigned ' +
+           'script would be rejected in the field. Only -DryRun may run without signing.')
+}
+if ($SigningEnabled -and ([string]::IsNullOrWhiteSpace($KeyVaultUrl) -or [string]::IsNullOrWhiteSpace($CertificateName))) {
+    throw '-SigningToken needs -KeyVaultUrl and -CertificateName.'
+}
+
 function Get-HttpStatus {
     param($ErrorRecord)
     if ($ErrorRecord.Exception.PSObject.Properties['Response'] -and $ErrorRecord.Exception.Response) {
@@ -125,6 +163,132 @@ function Get-PublishBytes {
     return ,(New-Object System.Text.UTF8Encoding $false).GetBytes($normalised)
 }
 
+# A PowerShell signature is appended as a comment block at the end of the file, so the
+# published bytes are "source + signature". Everything that compares a published script to
+# its source has to cut that block off first -- the signature carries a timestamp and is
+# therefore different on every publish, while the script above it is unchanged.
+function Remove-SignatureBlock {
+    param([string]$Text)
+    $marker = '# SIG # Begin signature block'
+    $index = $Text.IndexOf($marker)
+    if ($index -lt 0) { return $Text }
+    return $Text.Substring(0, $index)
+}
+
+# Comparison form: no signature, LF, no trailing blank lines. Used for "is the published
+# copy still this source" -- never for what gets uploaded.
+function Get-ComparableText {
+    param([string]$Text)
+    return (Remove-SignatureBlock $Text).Replace("`r`n", "`n").TrimEnd("`n")
+}
+
+# Signs the publish set in place: each item's bytes are written to a work directory, signed
+# there, verified, and read back as the bytes that will be uploaded. Signing has to be the
+# last transformation -- the signature covers exactly these bytes, so nothing may normalise
+# or re-encode them afterwards.
+function Set-PublishSetSignature {
+    param([object[]]$Items, [string]$WorkDir)
+
+    if (-not (Get-Command azuresigntool -ErrorAction SilentlyContinue)) {
+        throw "azuresigntool is not on PATH. Install it with: dotnet tool install --global AzureSignTool --version 7.0.1"
+    }
+
+    New-Item -ItemType Directory -Force -Path $WorkDir | Out-Null
+
+    $paths = @()
+    foreach ($item in $Items) {
+        $path = Join-Path $WorkDir $item.BlobName
+        [System.IO.File]::WriteAllBytes($path, [byte[]]$item.Bytes)
+        $paths += $path
+    }
+
+    Write-Host "Signing $($paths.Count) script(s) with certificate '$CertificateName'..."
+    & azuresigntool.exe sign --verbose `
+        --azure-key-vault-url $KeyVaultUrl `
+        --azure-key-vault-accesstoken $SigningToken `
+        --azure-key-vault-certificate $CertificateName `
+        --timestamp-rfc3161 $TimestampUrl `
+        --file-digest sha256 `
+        --description 'Autopilot Monitor bootstrap' `
+        --description-url 'https://www.autopilotmonitor.com' `
+        $paths
+
+    # Native tool: PowerShell does not throw on a non-zero exit, and an unnoticed signing
+    # failure would publish unsigned scripts that every loader in the field then rejects.
+    if ($LASTEXITCODE -ne 0) {
+        throw "azuresigntool failed with exit code $LASTEXITCODE -- nothing was uploaded."
+    }
+
+    foreach ($item in $Items) {
+        $path = Join-Path $WorkDir $item.BlobName
+        $sig = Get-AuthenticodeSignature -FilePath $path
+        if ($sig.Status -ne 'Valid') {
+            throw "Signature on $($item.BlobName) is '$($sig.Status)', expected 'Valid'."
+        }
+        # Without a timestamp the signature dies with the certificate, and these scripts sit
+        # on customer devices far longer than a certificate lifetime.
+        if (-not $sig.TimeStamperCertificate) {
+            throw "Signature on $($item.BlobName) carries no timestamp."
+        }
+        if ($ExpectedPublisher -and $sig.SignerCertificate.Subject -notlike $ExpectedPublisher) {
+            throw "$($item.BlobName) was signed by '$($sig.SignerCertificate.Subject)', expected '$ExpectedPublisher'."
+        }
+        # Plain assignment, NO comma operator: the ',' elsewhere in this file exists because
+        # PowerShell unrolls an array RETURNED from a function, which is not what a property
+        # assignment does -- here it would wrap the byte[] in an Object[] of length 1 and the
+        # upload would fail converting it back.
+        $signedBytes = [System.IO.File]::ReadAllBytes($path)
+        if ($signedBytes.Length -le $item.Bytes.Length) {
+            throw ("Signed $($item.BlobName) is $($signedBytes.Length) bytes but the unsigned form " +
+                   "was $($item.Bytes.Length) -- a signature only ever adds bytes, so this is a " +
+                   'read-back bug, not a signing result.')
+        }
+        $item.Bytes = $signedBytes
+        Write-Host "  signed $($item.BlobName) ($($signedBytes.Length) bytes, signer $($sig.SignerCertificate.Subject.Split(',')[0]))"
+    }
+}
+
+# Aborts when a published script changed behaviour without a version bump. Consumers act on
+# the version (docs badge, version.json, the portal's outdated-script hint), so an unchanged
+# version has to mean unchanged behaviour.
+function Assert-VersionBump {
+    param(
+        [string]$BlobName,
+        [string]$SourceContent,
+        [string]$SourceOrigin,
+        [string]$SourceVersion
+    )
+
+    $publishedBytes = Get-PublishedBytes "$AliasUrl/$BlobName"
+    if ($null -eq $publishedBytes) {
+        Write-Host "No published $BlobName yet -- version-bump guard skipped (first publish)"
+        return
+    }
+
+    $publishedText = [System.Text.Encoding]::UTF8.GetString($publishedBytes)
+    if ((Get-ComparableText $publishedText) -eq (Get-ComparableText $SourceContent)) {
+        Write-Host "Published $BlobName is already this source (signature block aside)"
+        return
+    }
+
+    $publishedVersion = Get-BootstrapScriptVersion -Content $publishedText -Origin "$AliasUrl/$BlobName" -Optional
+
+    if ($null -eq $publishedVersion) {
+        Write-Host "::warning::The published $BlobName is not a readable script (no ScriptVersion found). Republishing over it."
+    } elseif ($publishedVersion -ne $SourceVersion) {
+        Write-Host "Version bump: $publishedVersion -> $SourceVersion ($BlobName)"
+    } elseif ((Get-CodeFingerprint -Text (Remove-SignatureBlock $publishedText) -Origin "$AliasUrl/$BlobName") -eq
+              (Get-CodeFingerprint -Text $SourceContent -Origin $SourceOrigin)) {
+        # Comments, typos in comments, reflow -- nothing a consumer of the version can act on.
+        Write-Host "::warning::$BlobName changed in comments or formatting only; publishing under the unchanged version $SourceVersion."
+    } else {
+        throw ("Version-bump guard: $BlobName changed behaviour but ScriptVersion is still $SourceVersion. " +
+               "Bump it in $SourceOrigin -- the docs badge, version.json and the " +
+               'portal outdated-script hint all read that value, and customers decide from it whether ' +
+               'to re-upload their Intune copy. Comment-only and formatting changes do not need a bump.')
+    }
+}
+
 function Get-BootstrapScriptVersion {
     param([string]$Content, [string]$Origin, [switch]$Optional)
     if ($Content -match '\$ScriptVersion\s*=\s*"([\d\.\-a-zA-Z]+)"') { return $Matches[1] }
@@ -152,12 +316,16 @@ function Get-CodeFingerprint {
     return (($tokens | Where-Object { $ignored -notcontains $_.Kind.ToString() } | ForEach-Object { $_.Text }) -join "`n")
 }
 
-# ------------------------------------------------------------------ 1. source
+# ------------------------------------------------------------------ 1. sources
 $sourceContent = Get-Content $BootstrapSource -Raw
 $sourceBytes   = Get-PublishBytes $sourceContent
 $scriptVersion = Get-BootstrapScriptVersion -Content $sourceContent -Origin $BootstrapSource
 Write-Host "Bootstrap script version: $scriptVersion"
 
+$loaderContent = Get-Content $LoaderSource -Raw
+$loaderVersion = Get-BootstrapScriptVersion -Content $loaderContent -Origin $LoaderSource
+Write-Host "Loader script version: $loaderVersion"
+
 # ------------------------------------------------------------------ 2. dev render
 $stableUrlLiteral = '$AgentDownloadUrl = "https://download.autopilotmonitor.com/agent/AutopilotMonitor-Agent.zip"'
 $devUrlLiteral    = '$AgentDownloadUrl = "https://download.autopilotmonitor.com/agent/AutopilotMonitor-Agent-dev.zip"'
@@ -170,33 +338,21 @@ if ($sourceContent.IndexOf($stableUrlLiteral) -lt 0 -or $sourceContent.IndexOf($
 $devContent = $sourceContent.Replace($stableUrlLiteral, $devUrlLiteral).Replace($stableManLiteral, $devManLiteral)
 Write-Host "Rendered $DevBlob (dev agent URL + version-dev.json)"
 
-# ------------------------------------------------------------------ 3. bump guard
-$publishedBytes = Get-PublishedBytes "$AliasUrl/$BootstrapBlob"
-if ($null -eq $publishedBytes) {
-    Write-Host 'No published bootstrap yet -- version-bump guard skipped (first publish)'
-} elseif ((Get-Sha256 $publishedBytes) -eq (Get-Sha256 $sourceBytes)) {
-    Write-Host 'Published bootstrap is already byte-identical to the source'
-} else {
-    $publishedText    = [System.Text.Encoding]::UTF8.GetString($publishedBytes)
-    $publishedVersion = Get-BootstrapScriptVersion -Content $publishedText -Origin "$AliasUrl/$BootstrapBlob" -Optional
+# The dev loader must fetch the dev bootstrap, or a dev device would run the stable chain.
+$stableLoaderLiteral = '$BootstrapUrl = "https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor.ps1"'
+$devLoaderLiteral    = '$BootstrapUrl = "https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor-Dev.ps1"'
 
-    if ($null -eq $publishedVersion) {
-        Write-Host "::warning::The published $BootstrapBlob is not a readable bootstrap script (no ScriptVersion found). Republishing over it."
-    } elseif ($publishedVersion -ne $scriptVersion) {
-        Write-Host "Version bump: $publishedVersion -> $scriptVersion"
-    } elseif ((Get-CodeFingerprint -Text $publishedText -Origin "$AliasUrl/$BootstrapBlob") -eq
-              (Get-CodeFingerprint -Text $sourceContent -Origin $BootstrapSource)) {
-        # Comments, typos in comments, reflow -- nothing a consumer of the version can act on.
-        Write-Host "::warning::$BootstrapBlob changed in comments or formatting only; publishing under the unchanged version $scriptVersion."
-    } else {
-        throw ("Version-bump guard: $BootstrapBlob changed behaviour but ScriptVersion is still $scriptVersion. " +
-               "Bump it in $BootstrapSource -- the docs badge, version.json.bootstrapVersion and the " +
-               'portal outdated-script hint all read that value, and customers decide from it whether ' +
-               'to re-upload their Intune copy. Comment-only and formatting changes do not need a bump.')
-    }
+if ($loaderContent.IndexOf($stableLoaderLiteral) -lt 0) {
+    throw "Loader dev-render: anchor literal missing in $LoaderSource"
 }
+$devLoaderContent = $loaderContent.Replace($stableLoaderLiteral, $devLoaderLiteral)
+Write-Host "Rendered $LoaderDevBlob (points at $DevBlob)"
 
-# ------------------------------------------------------------------ 4. upload
+# ------------------------------------------------------------------ 3. bump guards
+Assert-VersionBump -BlobName $BootstrapBlob -SourceContent $sourceContent -SourceOrigin $BootstrapSource -SourceVersion $scriptVersion
+Assert-VersionBump -BlobName $LoaderBlob    -SourceContent $loaderContent -SourceOrigin $LoaderSource    -SourceVersion $loaderVersion
+
+# ------------------------------------------------------------------ 4. publish set
 # Sources beyond the bootstrap pair, read straight from the repo.
 $extraSources = @(
     @{ Path = 'scripts/Bootstrap/Test-ShouldBootstrapAgent.ps1';       BlobName = 'Test-ShouldBootstrapAgent.ps1' }
@@ -206,20 +362,38 @@ $extraSources = @(
 # Uninstall-AutopilotMonitor.ps1 is deliberately NOT published: nothing links it, and
 # an unauthenticated uninstall script on the public download host is not a feature.
 
+# Text is the unsigned publish form and stays the reference for every comparison against a
+# published copy; Bytes is what goes on the wire and carries the signature after step 4.
 $publishSet = [System.Collections.Generic.List[object]]::new()
-$publishSet.Add([pscustomobject]@{ BlobName = $BootstrapBlob; Bytes = $sourceBytes })
-$publishSet.Add([pscustomobject]@{ BlobName = $DevBlob;       Bytes = (Get-PublishBytes $devContent) })
+$publishSet.Add([pscustomobject]@{ BlobName = $LoaderBlob;    Text = $loaderContent;    Bytes = (Get-PublishBytes $loaderContent) })
+$publishSet.Add([pscustomobject]@{ BlobName = $LoaderDevBlob; Text = $devLoaderContent; Bytes = (Get-PublishBytes $devLoaderContent) })
+$publishSet.Add([pscustomobject]@{ BlobName = $BootstrapBlob; Text = $sourceContent;    Bytes = $sourceBytes })
+$publishSet.Add([pscustomobject]@{ BlobName = $DevBlob;       Text = $devContent;       Bytes = (Get-PublishBytes $devContent) })
 foreach ($extra in $extraSources) {
     $extraPath = Join-Path $RepoRoot $extra.Path
     if (-not (Test-Path $extraPath)) {
         throw "Publish source missing: $extraPath"
     }
-    $publishSet.Add([pscustomobject]@{ BlobName = $extra.BlobName; Bytes = (Get-PublishBytes (Get-Content $extraPath -Raw)) })
+    $extraText = Get-Content $extraPath -Raw
+    $publishSet.Add([pscustomobject]@{ BlobName = $extra.BlobName; Text = $extraText; Bytes = (Get-PublishBytes $extraText) })
+}
+
+# ------------------------------------------------------------------ 5. sign
+# After this point the bytes are final. Normalising, re-encoding or rewriting a line ending
+# would invalidate the signature, and the device-side loader would refuse the script.
+if ($SigningEnabled) {
+    Set-PublishSetSignature -Items $publishSet -WorkDir (Join-Path ([System.IO.Path]::GetTempPath()) "apm-publish-$PID")
+} else {
+    Write-Host '::warning::No signing token supplied -- dry run continues with unsigned scripts.'
 }
 
 $legacySas = if ($LegacySasToken) { $LegacySasToken.TrimStart('?') } else { '' }
-$writeSas  = if ($SasToken) { $SasToken.TrimStart('?') } else { '' }
 
+# Acquired lazily: a dry run must stay runnable without any Azure login -- the PR gate
+# (bootstrap-script-gates.yml) executes this script with -DryRun and never logs in.
+$authHeaders = if ($DryRun) { $null } else { & (Join-Path $PSScriptRoot 'Get-StorageAuthHeaders.ps1') }
+
+# ------------------------------------------------------------------ 6. upload
 foreach ($item in $publishSet) {
     # Explicit type, not a convenience: an Object[] body is uploaded as space-separated
     # decimals rather than raw bytes, and every hash check still passes because [byte[]]
@@ -227,11 +401,21 @@ foreach ($item in $publishSet) {
     [byte[]]$bytes = $item.Bytes
     $item | Add-Member -NotePropertyName Sha256 -NotePropertyValue (Get-Sha256 $bytes) -Force
 
+    # Exactly the bytes that go on the wire, for the CI artifact. Written in a dry run too:
+    # that is the run an operator uses to inspect a signed script before it is published.
+    if ($SignedOutputDir) {
+        New-Item -ItemType Directory -Force -Path $SignedOutputDir | Out-Null
+        [System.IO.File]::WriteAllBytes((Join-Path $SignedOutputDir $item.BlobName), $bytes)
+    }
+
     if ($DryRun) {
-        # Doubles as a drift check: says per blob whether the alias already serves this source.
+        # Doubles as a drift check: says per blob whether the alias already serves this
+        # source. Compared as text without the signature block -- signed bytes differ on
+        # every run, so a byte comparison would report drift for every unchanged script.
         $served = Get-PublishedBytes "$AliasUrl/$($item.BlobName)"
         $state = if ($null -eq $served) { 'MISSING on the alias' }
-                 elseif ((Get-Sha256 $served) -eq $item.Sha256) { 'already current' }
+                 elseif ((Get-ComparableText ([System.Text.Encoding]::UTF8.GetString($served))) -eq
+                         (Get-ComparableText $item.Text)) { 'already current' }
                  else { 'STALE on the alias' }
         Write-Host "  [dry-run] $($item.BlobName) ($($bytes.Length) bytes, sha256 $($item.Sha256)) -- $state"
         continue
@@ -241,8 +425,18 @@ foreach ($item in $publishSet) {
     # with Front Door. Route caching is disabled there, but a stale script paired with a
     # fresh manifest would fail the bootstrap SHA check -- this keeps that class of bug
     # impossible even if caching is ever re-enabled.
-    $headers = @{ 'x-ms-blob-type' = 'BlockBlob'; 'Content-Type' = $ScriptContentType; 'x-ms-blob-cache-control' = 'no-cache' }
-    Invoke-RestMethod -Uri "$ContainerUrl/$($item.BlobName)?$writeSas" -Method Put -Headers $headers -Body $bytes | Out-Null
+    #
+    # Content-Disposition: without it a text/plain blob opens as a web page in every
+    # browser, and the documented "download the script" step silently becomes "copy this
+    # text". The header makes the link a download everywhere, and command-line clients
+    # (the loader, the MSI, curl) ignore it.
+    $headers = @{
+        'x-ms-blob-type'                = 'BlockBlob'
+        'Content-Type'                  = $ScriptContentType
+        'x-ms-blob-cache-control'       = 'no-cache'
+        'x-ms-blob-content-disposition' = ('attachment; filename="{0}"' -f $item.BlobName)
+    }
+    Invoke-RestMethod -Uri "$ContainerUrl/$($item.BlobName)" -Method Put -Headers ($authHeaders + $headers) -Body $bytes | Out-Null
 
     # Read straight back from the blob (authoritative, no CDN in the way) before touching the
     # mirror or the next file. The alias verification at the end would catch a bad body too,
@@ -266,7 +460,7 @@ foreach ($item in $publishSet) {
     }
 }
 
-# ------------------------------------------------------------------ 5. version oracles
+# ------------------------------------------------------------------ 7. version oracles
 # version.json is the agent manifest; only bootstrapVersion belongs to us. Read from the
 # blob (not the alias) for an authoritative ETag, write back under If-Match so a concurrent
 # agent release cannot lose its version/sha256 fields.
@@ -278,11 +472,15 @@ if (-not $DryRun) {
         } else { [string]$manifestResp.Content }
         $manifest = $manifestRaw | ConvertFrom-Json
 
-        if ($manifest.bootstrapVersion -eq $scriptVersion) {
-            Write-Host "version.json already reports bootstrapVersion $scriptVersion"
+        if ($manifest.bootstrapVersion -eq $scriptVersion -and $manifest.loaderVersion -eq $loaderVersion) {
+            Write-Host "version.json already reports bootstrapVersion $scriptVersion and loaderVersion $loaderVersion"
         } else {
             $etag = '"' + ([string]($manifestResp.Headers['ETag'] | Select-Object -First 1)).Trim('"') + '"'
             $manifest | Add-Member -NotePropertyName 'bootstrapVersion' -NotePropertyValue $scriptVersion -Force
+            # Additive: no consumer reads loaderVersion yet. It exists so support can tell
+            # which stage-1 file a device was assigned -- stage 2 is always current by
+            # construction, so its version says nothing about the customer's Intune copy.
+            $manifest | Add-Member -NotePropertyName 'loaderVersion' -NotePropertyValue $loaderVersion -Force
             $body = [System.Text.Encoding]::UTF8.GetBytes(($manifest | ConvertTo-Json -Compress))
             $manifestHeaders = @{
                 'x-ms-blob-type'          = 'BlockBlob'
@@ -290,8 +488,8 @@ if (-not $DryRun) {
                 'x-ms-blob-cache-control' = 'no-cache'
                 'If-Match'                = $etag
             }
-            Invoke-RestMethod -Uri "$ContainerUrl/version.json?$writeSas" -Method Put -Headers $manifestHeaders -Body $body | Out-Null
-            Write-Host "version.json bootstrapVersion -> $scriptVersion (agent fields untouched)"
+            Invoke-RestMethod -Uri "$ContainerUrl/version.json" -Method Put -Headers ($authHeaders + $manifestHeaders) -Body $body | Out-Null
+            Write-Host "version.json bootstrapVersion -> $scriptVersion, loaderVersion -> $loaderVersion (agent fields untouched)"
 
             if ($legacySas) {
                 try {
@@ -310,11 +508,8 @@ if (-not $DryRun) {
     }
 }
 
-$tableSas = if ($TableSasToken) { $TableSasToken.TrimStart('?') } else { '' }
 if ($DryRun) {
     Write-Host "  [dry-run] would set AdminConfiguration.LatestBootstrapV2ScriptVersion = $scriptVersion"
-} elseif ([string]::IsNullOrEmpty($tableSas) -or $tableSas -eq 'XXX') {
-    Write-Host 'SKIPPED: AdminConfiguration update -- set AZURE_TABLE_ADMIN_SAS_TOKEN to enable the portal version oracle'
 } else {
     $tableHeaders = @{
         'Content-Type' = 'application/json'
@@ -322,11 +517,11 @@ if ($DryRun) {
         'If-Match'     = '*'
     }
     $tableBody = @{ LatestBootstrapV2ScriptVersion = $scriptVersion } | ConvertTo-Json
-    Invoke-RestMethod -Uri "$TableUrl`?$tableSas" -Method Merge -Headers $tableHeaders -Body $tableBody | Out-Null
+    Invoke-RestMethod -Uri $TableUrl -Method Merge -Headers ($authHeaders + $tableHeaders) -Body $tableBody | Out-Null
     Write-Host "AdminConfiguration.LatestBootstrapV2ScriptVersion = $scriptVersion"
 }
 
-# ------------------------------------------------------------------ 6. verify via alias
+# ------------------------------------------------------------------ 8. verify via alias
 if (-not $DryRun) {
     $pending = [System.Collections.ArrayList]::new()
     $publishSet | ForEach-Object { [void]$pending.Add($_) }
@@ -358,7 +553,8 @@ if ($env:GITHUB_STEP_SUMMARY) {
     $summary = @(
         "### Bootstrap scripts: $mode",
         '',
-        "Bootstrap script version: **$scriptVersion**",
+        "Loader script version: **$loaderVersion** | Bootstrap script version: **$scriptVersion**",
+        "Signed: **$(if ($SigningEnabled) { "yes, certificate '$CertificateName'" } else { 'NO (unsigned dry run)' })**",
         ''
     ) + ($publishSet | ForEach-Object { "- $($_.BlobName) -- sha256 $($_.Sha256)" })
     ($summary -join [Environment]::NewLine) | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8

.github/scripts/Request-BuildNumber.ps1

@@ -12,7 +12,8 @@
     A failed build burns a number, which is harmless -- uniqueness matters,
     density does not.
 
-    The blob is public-read; only the write needs the container SAS.
+    The blob is public-read; only the write needs authorization, and that comes from the
+    ambient Entra identity (see Get-StorageAuthHeaders.ps1) -- no secret is passed in.
 
     Why a counter and not the published version manifest: manifests are written
     on publish, not on build (the agent writes version.json only for stable
@@ -20,10 +21,7 @@
     overwrite each other's versioned artifact.
 
 .PARAMETER CounterUrl
-    Full URL of the counter blob, without SAS.
-
-.PARAMETER SasToken
-    Container SAS with create+write permission. A leading '?' is tolerated.
+    Full URL of the counter blob.
 
 .PARAMETER Override
     Explicit build number instead of counter+1. If it is not greater than the
@@ -37,20 +35,19 @@
     [int] the reserved build number. Progress goes to the host, not the pipeline.
 
 .EXAMPLE
-    $n = ./Request-BuildNumber.ps1 -CounterUrl $url -SasToken $sas
+    $n = ./Request-BuildNumber.ps1 -CounterUrl $url
 #>
 [CmdletBinding()]
 param(
     [Parameter(Mandatory = $true)][string]$CounterUrl,
-    [Parameter(Mandatory = $true)][string]$SasToken,
     [int]$Override = 0,
     [int]$MaxAttempts = 5
 )
 
 $ErrorActionPreference = 'Stop'
 
-# Tolerate both secret formats ("sp=cw&..." and "?sp=cw&...").
-$writeUrl = $CounterUrl + '?' + $SasToken.TrimStart('?')
+# The write is Entra-authorized; the read below stays anonymous (public container).
+$authHeaders = & (Join-Path $PSScriptRoot 'Get-StorageAuthHeaders.ps1')
 
 function Get-HttpStatus {
     param($ErrorRecord)
@@ -85,8 +82,8 @@ for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
     $target = if ($Override -gt 0) { $Override } else { $counter.Value + 1 }
 
     try {
-        $headers = @{ 'x-ms-blob-type' = 'BlockBlob'; 'If-Match' = $counter.ETag }
-        Invoke-RestMethod -Uri $writeUrl -Method Put -Headers $headers -Body "$target" -ContentType 'text/plain' | Out-Null
+        $headers = $authHeaders + @{ 'x-ms-blob-type' = 'BlockBlob'; 'If-Match' = $counter.ETag }
+        Invoke-RestMethod -Uri $CounterUrl -Method Put -Headers $headers -Body "$target" -ContentType 'text/plain' | Out-Null
         Write-Host "  Reserved build number $target (CAS write ok, attempt $attempt)"
         return $target
     } catch {

.github/workflows/action-pins.yml

@@ -0,0 +1,70 @@
+name: Action Pin Gate
+
+# Every third-party action must be referenced by a full commit SHA, never by a tag.
+# Tags are mutable: whoever controls an action repository can repoint v4 at new code,
+# and that code runs inside jobs that hold the code-signing identity, the storage
+# credentials and a token that can push to main. A SHA is the only reference an
+# upstream owner cannot change under us.
+#
+# Lives in its own workflow rather than in ci.yml: CI deliberately ignores changes to
+# the other workflow files, so a guard placed there would stay silent for exactly the
+# commits it needs to inspect.
+#
+# Like CI, this reports rather than blocks: main is deliberately unprotected, so a red
+# run is a signal to act on, not a merge barrier. Making it binding means adding
+# 'Verify action pins' as a required status check -- a branch-protection decision, not
+# something this file can assert.
+#
+# The pins are not maintained by hand — .github/dependabot.yml opens a monthly grouped
+# PR that rewrites both the SHA and the trailing version comment. The comment is
+# therefore required too: it is what makes a pinned line reviewable.
+
+on:
+  push:
+    branches: [main]
+    paths: ['.github/workflows/**']
+  pull_request:
+    branches: [main]
+    paths: ['.github/workflows/**']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  verify-pins:
+    name: Verify action pins
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Every third-party action is pinned to a SHA
+        run: |
+          set -uo pipefail
+          failed=0
+          while IFS=: read -r file line ref; do
+            # Reusable workflows from this repository move with the commit that calls
+            # them, so there is nothing to pin.
+            case "$ref" in ./*) continue ;; esac
+
+            if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]+#[[:space:]]*[^[:space:]] ]]; then
+              printf 'ok  %s:%s  %s\n' "$file" "$line" "$ref"
+              continue
+            fi
+
+            if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]*$ ]]; then
+              echo "::error file=$file,line=$line::Pinned but the version comment is missing: '$ref'. Write 'owner/action@<sha> # vN' so the line stays reviewable."
+            else
+              echo "::error file=$file,line=$line::Action '$ref' is not pinned to a commit SHA. Tags are mutable -- resolve it with: gh api repos/<owner>/<action>/git/ref/tags/<tag>"
+            fi
+            failed=1
+          # -H is load-bearing: with a single matching file grep omits the name, the
+          # fields shift by one and every diagnostic points at nothing.
+          done < <(grep -nHE '^[[:space:]]*(-[[:space:]]+)?uses:' .github/workflows/*.yml \
+                   | sed -E 's/^([^:]+):([0-9]+):[[:space:]]*(-[[:space:]]+)?uses:[[:space:]]*/\1:\2:/')
+
+          if [ "$failed" -ne 0 ]; then
+            echo "::error::Unpinned action references found -- fix them before this reaches main."
+            exit 1
+          fi
+          echo "All action references are pinned to commit SHAs."

.github/workflows/bootstrap-script-gates.yml

@@ -18,7 +18,7 @@ jobs:
     name: Bootstrap guard tests (PS 5.1)
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install Pester 5+
         shell: powershell

.github/workflows/build-agent.yml

@@ -57,6 +57,13 @@ env:
   VERSIONED_ZIP: AutopilotMonitor-Agent-v2.zip
   STABLE_ZIP: AutopilotMonitor-Agent.zip
   STABLE_MANIFEST: version.json
+  # Authenticode via Azure Key Vault; identity and vault come from repository variables.
+  # CODE_SIGN_EXPECTED_SUBJECT is optional and pins the publisher in the verify step.
+  CODE_SIGN_CLIENT_ID: ${{ vars.CODE_SIGN_CLIENT_ID }}
+  CODE_SIGN_CERTIFICATE_NAME: ${{ vars.CODE_SIGN_CERTIFICATE_NAME }}
+  CODE_SIGN_KEY_VAULT_URL: ${{ vars.CODE_SIGN_KEY_VAULT_URL }}
+  CODE_SIGN_EXPECTED_SUBJECT: ${{ vars.CODE_SIGN_EXPECTED_SUBJECT }}
+  CODE_SIGN_TIMESTAMP_URL: http://timestamp.acs.microsoft.com
 
 jobs:
   build:
@@ -65,14 +72,66 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      # Every released build is signed; a missing variable stops the run before a build
+      # number is burnt.
+      - name: Check code-signing configuration
+        shell: pwsh
+        run: |
+          foreach ($name in 'CODE_SIGN_CLIENT_ID', 'CODE_SIGN_CERTIFICATE_NAME', 'CODE_SIGN_KEY_VAULT_URL') {
+            if ([string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($name))) {
+              throw "Repository variable $name is not set. Every released build must be Authenticode-signed."
+            }
+          }
+          Write-Host "Code-signing configuration present (certificate '$env:CODE_SIGN_CERTIFICATE_NAME')"
+
+      # Logs in FIRST and only to fetch the Key Vault token: azure/login sets the default az
+      # account, so the storage login below has to be the last one. Both federated credentials
+      # are bound to the ref, so this job must never be given an `environment:` -- that would
+      # change the OIDC subject claim and break both logins.
+      - name: Login to Azure (code-signing identity)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ env.CODE_SIGN_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          allow-no-subscriptions: true
+
+      - name: Acquire Key Vault token for signing
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $token = az account get-access-token --scope https://vault.azure.net/.default --query accessToken --output tsv
+          if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($token)) {
+            throw "Could not acquire a Key Vault token for the code-signing identity."
+          }
+          Write-Host "::add-mask::$token"
+          "CODE_SIGN_AKV_ACCESS_TOKEN=$token" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      # Every storage write below (counter blob, agent ZIP, manifests, AdminConfiguration)
+      # is authorized by this federated identity -- no SAS secret. One login covers the whole
+      # job: the federated credential is bound to the ref, and a release run takes ~2 minutes,
+      # well inside the token lifetime. Only the legacy mirror still needs a SAS: that account
+      # lives in the pre-migration tenant, where this principal has no identity.
+      - name: Login to Azure (OIDC)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       # SDK 10 = single build toolchain (parity with local build.ps1 / global.json).
       - name: Setup .NET
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         with:
           dotnet-version: '10.0.x'
 
+      # Version pinned; roll-forward because the tool targets an older runtime than the SDK above.
+      - name: Install AzureSignTool
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: dotnet tool install --no-cache --global AzureSignTool --version 7.0.1
+
       # Build numbers come from the shared counter blob -- one counter and one
       # implementation for CI and the local build (.github/scripts/Request-BuildNumber.ps1).
       # Reserve-before-build with ETag-CAS: concurrent builds can never mint the same
@@ -85,7 +144,6 @@ jobs:
         # build_number could otherwise break out of the quotes and run arbitrary code.
         env:
           BUILD_NUMBER_OVERRIDE: ${{ inputs.build_number }}
-          AGENT_SAS_TOKEN: ${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}
         run: |
           $override = 0
           if ($env:BUILD_NUMBER_OVERRIDE -ne '') {
@@ -96,7 +154,7 @@ jobs:
           }
 
           $counterUrl = "https://autopilotmonitoreu.blob.core.windows.net/agent/buildcounter-v$($env:LINE_MAJOR).txt"
-          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl $counterUrl -SasToken $env:AGENT_SAS_TOKEN -Override $override
+          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl $counterUrl -Override $override
 
           $csproj = Get-Content $env:CSPROJ_PATH -Raw
           if ($csproj -match '<VersionPrefix>(\d+\.\d+)</VersionPrefix>') {
@@ -129,6 +187,47 @@ jobs:
       - name: Run Agent unit tests
         run: dotnet test ${{ env.TEST_PROJECT }} --configuration Release --no-restore --verbosity quiet
 
+      # Authenticode over everything we author; third-party assemblies keep their own signature.
+      #
+      # THE POSITION IS LOAD-BEARING: signing rewrites the PE file, so it must run before the
+      # ZIP and every SHA-256 in the next step -- those hashes are the bootstrap's integrity
+      # oracle, and hashes taken before signing match no downloaded file.
+      #
+      # $LASTEXITCODE is checked explicitly: PowerShell does not throw on a native non-zero exit.
+      - name: Sign agent binaries (Authenticode)
+        shell: pwsh
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: |
+          $ErrorActionPreference = 'Stop'
+
+          $targets = @()
+          $targets += Get-ChildItem -Path "$env:AGENT_OUTPUT/*" -Include 'AutopilotMonitor.*.exe', 'AutopilotMonitor.*.dll' -File
+          $targets += Get-ChildItem -Path "$env:DIALOG_OUTPUT/AutopilotMonitor.SummaryDialog.exe" -File
+
+          if (-not ($targets | Where-Object Name -eq 'AutopilotMonitor.Agent.exe')) {
+            throw "AutopilotMonitor.Agent.exe not found in $env:AGENT_OUTPUT -- nothing to sign."
+          }
+          if (-not ($targets | Where-Object Name -eq 'AutopilotMonitor.SummaryDialog.exe')) {
+            throw "AutopilotMonitor.SummaryDialog.exe not found in $env:DIALOG_OUTPUT -- nothing to sign."
+          }
+
+          $targets | ForEach-Object { Write-Host "Signing $($_.Name)" }
+
+          & azuresigntool.exe sign --verbose `
+            --azure-key-vault-url "$env:CODE_SIGN_KEY_VAULT_URL" `
+            --azure-key-vault-accesstoken "$env:CODE_SIGN_AKV_ACCESS_TOKEN" `
+            --azure-key-vault-certificate "$env:CODE_SIGN_CERTIFICATE_NAME" `
+            --timestamp-rfc3161 "$env:CODE_SIGN_TIMESTAMP_URL" `
+            --file-digest sha256 `
+            --description "Autopilot Monitor Agent" `
+            --description-url "https://www.autopilotmonitor.com" `
+            ($targets | ForEach-Object { $_.FullName })
+
+          if ($LASTEXITCODE -ne 0) {
+            throw "azuresigntool failed with exit code $LASTEXITCODE -- aborting before anything is published."
+          }
+
       - name: Create release artifact
         id: artifact
         shell: pwsh
@@ -219,12 +318,57 @@ jobs:
           "sha256=$sha256Hash" >> $env:GITHUB_OUTPUT
           "exe_sha256=$exeSha256Hash" >> $env:GITHUB_OUTPUT
 
+      # Verified against the STAGING copy -- the exact bytes that ship. The invariant is "every
+      # AutopilotMonitor PE in the ZIP is signed", so a project added later cannot ride along
+      # unsigned. A missing timestamp fails too: without it the signature dies with the cert.
+      - name: Verify Authenticode signatures
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $files = Get-ChildItem -Path "staging/agent/*" -Include 'AutopilotMonitor.*.exe', 'AutopilotMonitor.*.dll' -File
+          if ($files.Count -lt 2) {
+            throw "Expected signed binaries in staging/agent, found $($files.Count)."
+          }
+
+          $failed = $false
+          $thumbprints = @{}
+          foreach ($file in $files) {
+            $sig = Get-AuthenticodeSignature -FilePath $file.FullName
+            if ($sig.Status -ne 'Valid') {
+              Write-Host "::error file=$($file.Name)::Signature status is '$($sig.Status)' -- expected 'Valid'."
+              $failed = $true
+              continue
+            }
+            if (-not $sig.TimeStamperCertificate) {
+              Write-Host "::error file=$($file.Name)::Signature carries no RFC-3161 timestamp -- it would expire with the certificate."
+              $failed = $true
+              continue
+            }
+            if (-not [string]::IsNullOrWhiteSpace($env:CODE_SIGN_EXPECTED_SUBJECT) -and
+                $sig.SignerCertificate.Subject -notlike $env:CODE_SIGN_EXPECTED_SUBJECT) {
+              Write-Host "::error file=$($file.Name)::Signed by '$($sig.SignerCertificate.Subject)', expected '$env:CODE_SIGN_EXPECTED_SUBJECT'."
+              $failed = $true
+              continue
+            }
+            $thumbprints[$sig.SignerCertificate.Thumbprint] = $true
+            Write-Host "$($file.Name): Valid, timestamped $($sig.TimeStamperCertificate.Subject.Split(',')[0]), signer $($sig.SignerCertificate.Subject)"
+          }
+
+          if ($thumbprints.Count -gt 1) {
+            Write-Host "::error::Staged binaries carry $($thumbprints.Count) different signing certificates -- expected exactly one."
+            $failed = $true
+          }
+          if ($failed) {
+            throw "Signature verification failed. Nothing was published."
+          }
+          Write-Host "All $($files.Count) binaries signed with certificate $($thumbprints.Keys -join ', ')"
+
       - name: Upload to Azure Blob Storage
         if: inputs.upload_blob
         shell: pwsh
         run: |
           $containerUrl = "https://autopilotmonitoreu.blob.core.windows.net/agent"
-          $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}".TrimStart('?')
+          $authHeaders = & ./.github/scripts/Get-StorageAuthHeaders.ps1
           # Legacy mirror (transition until customers moved to the download.-alias):
           # blobs are ALSO pushed to the old account so the bootstrap URL baked into
           # customers' Intune scripts keeps serving current bits. Fail-soft -- a
@@ -234,7 +378,6 @@ jobs:
 
           function Send-Blob {
             param([string]$Local, [string]$BlobName, [string]$ContentType)
-            $url = "$containerUrl/$BlobName`?$sasToken"
             $bytes = [System.IO.File]::ReadAllBytes($Local)
             # no-cache on EVERY blob: they all rotate in place (even the per-line ZIP is
             # overwritten each build), and the download alias fronts them with Front Door.
@@ -248,7 +391,7 @@ jobs:
               $md5.Dispose()
             }
             Write-Host "Uploading $BlobName ($([math]::Round($bytes.Length / 1MB, 2)) MB)..."
-            Invoke-RestMethod -Uri $url -Method Put -Headers $headers -Body $bytes
+            Invoke-RestMethod -Uri "$containerUrl/$BlobName" -Method Put -Headers ($authHeaders + $headers) -Body $bytes
             Write-Host "  uploaded $BlobName"
             if (-not [string]::IsNullOrEmpty($legacySasToken)) {
               try {
@@ -274,56 +417,66 @@ jobs:
             # to main, so a release lands a set that is consistent with what is already live
             # (dev render, version-bump guard, bootstrapVersion oracles, alias verification).
             # Runs AFTER version.json so its bootstrapVersion read sees this build's manifest.
+            # Signed with the same identity: the device-side loader verifies the publisher
+            # of what it downloads, and the publisher refuses to upload unsigned scripts.
             ./.github/scripts/Publish-BootstrapScripts.ps1 `
-              -SasToken '${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}' `
               -LegacySasToken '${{ secrets.AZURE_BLOB_AGENT_LEGACY_SAS_TOKEN }}' `
-              -TableSasToken '${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}'
+              -SigningToken $env:CODE_SIGN_AKV_ACCESS_TOKEN `
+              -KeyVaultUrl $env:CODE_SIGN_KEY_VAULT_URL `
+              -CertificateName $env:CODE_SIGN_CERTIFICATE_NAME `
+              -TimestampUrl $env:CODE_SIGN_TIMESTAMP_URL `
+              -ExpectedPublisher $env:CODE_SIGN_EXPECTED_SUBJECT
           }
 
           # Update AdminConfiguration LatestAgentV2* -- ONLY on stable cutover. The hash-oracle
           # must never point at a build that is not actually in the stable namespace.
           # LatestBootstrapV2ScriptVersion is NOT set here: it belongs to the script publisher
           # above, which also owns it on script-only pushes. One writer per field.
-          $tableSasToken = "${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}".TrimStart('?')
           if ('${{ inputs.publish_as_stable }}' -ne 'true') {
             Write-Host "SKIPPED: AdminConfiguration update (versioned-only run -- stable namespace unchanged)"
-          } elseif ([string]::IsNullOrEmpty($tableSasToken) -or $tableSasToken -eq "XXX") {
-            Write-Host "SKIPPED: Table SAS token not configured -- set AZURE_TABLE_ADMIN_SAS_TOKEN secret to enable backend hash-oracle"
           } else {
             $sha256 = "${{ steps.artifact.outputs.sha256 }}"
             $exeSha256 = "${{ steps.artifact.outputs.exe_sha256 }}"
             $agentVersion = "${{ steps.version.outputs.version }}"
-            $tableUrl = "https://autopilotmonitoreu.table.core.windows.net/AdminConfiguration(PartitionKey='GlobalConfig',RowKey='config')?$tableSasToken"
+            $tableUrl = "https://autopilotmonitoreu.table.core.windows.net/AdminConfiguration(PartitionKey='GlobalConfig',RowKey='config')"
             $tableBody = @{
               LatestAgentV2Version    = $agentVersion
               LatestAgentV2Sha256     = $sha256
               LatestAgentV2ExeSha256  = $exeSha256
             }
-            Invoke-RestMethod -Uri $tableUrl -Method Merge -Headers @{
+            Invoke-RestMethod -Uri $tableUrl -Method Merge -Headers ($authHeaders + @{
               "Content-Type" = "application/json"
               "Accept"       = "application/json;odata=nometadata"
               "If-Match"     = "*"
-            } -Body ($tableBody | ConvertTo-Json)
+            }) -Body ($tableBody | ConvertTo-Json)
             Write-Host "AdminConfiguration updated: V2 version=$agentVersion, sha256=$sha256, exeSha256=$exeSha256"
           }
 
-      # Sigstore keyless provenance: binds the ZIP digest to this workflow run (repo, ref,
-      # commit, workflow file) in a public transparency log. The digest covers the identical
+      # Sigstore keyless provenance: binds the artifact digests to this workflow run (repo, ref,
+      # commit, workflow file) in a public transparency log. The digests cover the identical
       # bytes uploaded to blob (versioned AND stable), so one attestation covers all copies.
-      # Verify: gh attestation verify <zip> --repo okieselbach/AutopilotMonitor
-      - name: Attest build provenance (ZIP)
-        uses: actions/attest-build-provenance@v4
+      # Complements Authenticode rather than replacing it: the signature says who published a
+      # binary, the attestation which build produced these exact bytes. Both EXEs are subjects
+      # of their own so an extracted binary can be verified without the ZIP.
+      # Verify: gh attestation verify <file> --repo okieselbach/AutopilotMonitor
+      # Skipped on runs that publish nothing -- no log entry for bytes nobody receives.
+      - name: Attest build provenance
+        if: inputs.upload_blob || inputs.create_release
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
         with:
-          subject-path: ${{ steps.artifact.outputs.versioned_zip_release }}
+          subject-path: |
+            ${{ steps.artifact.outputs.versioned_zip_release }}
+            staging/agent/AutopilotMonitor.Agent.exe
+            staging/agent/AutopilotMonitor.SummaryDialog.exe
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: AutopilotMonitor-Agent-v${{ steps.version.outputs.version }}
           path: ${{ steps.artifact.outputs.versioned_zip_release }}
 
       - name: Upload version metadata
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: version-metadata
           path: ${{ env.MANIFEST_NAME }}
@@ -356,7 +509,7 @@ jobs:
             - **Published as stable:** ${{ inputs.publish_as_stable }}
 
             ### Provenance
-            This ZIP carries a [GitHub Artifact Attestation](https://github.com/okieselbach/AutopilotMonitor/attestations) (Sigstore keyless). Verify:
+            The executables are Authenticode-signed and timestamped. The ZIP and both executables carry a [GitHub Artifact Attestation](https://github.com/okieselbach/AutopilotMonitor/attestations) (Sigstore keyless). Verify:
             ```
             gh attestation verify AutopilotMonitor-Agent-v${{ steps.version.outputs.version }}.zip --repo okieselbach/AutopilotMonitor
             ```

.github/workflows/build-msi.yml

@@ -1,11 +1,11 @@
 name: Build & Publish Bootstrap MSI
 
 # Thin MDM LOB delivery vehicle for WDP (Autopilot v2) — see
-# src/Agent/AutopilotMonitor.BootstrapMsi/Package.wxs. The MSI carries no bootstrap
-# logic (only the runner script that downloads the CURRENT server-hosted
-# Install-AutopilotMonitor.ps1), so it is rebuilt rarely: only when the runner script
-# or the WiX package changes. Version lives in Package.wxs — bump it there before
-# dispatching so Intune LOB update detection sees a new ProductVersion.
+# src/Agent/AutopilotMonitor.BootstrapMsi/Package.wxs. The MSI is packaging only: it
+# carries the SAME stage-1 loader that is assigned directly in Intune, so it is rebuilt
+# rarely — only when that loader or the WiX package changes. Version lives in Package.wxs
+# — bump it there before dispatching so Intune LOB update detection sees a new
+# ProductVersion.
 
 on:
   workflow_dispatch:
@@ -23,8 +23,15 @@ permissions:
 
 env:
   MSI_PROJECT_DIR: src/Agent/AutopilotMonitor.BootstrapMsi
-  RUNNER_SCRIPT: src/Agent/AutopilotMonitor.BootstrapMsi/Invoke-BootstrapDownload.ps1
+  RUNNER_SCRIPT: scripts/Bootstrap/Start-AutopilotMonitor.ps1
   STABLE_MSI: AutopilotMonitor-Bootstrap.msi
+  # Authenticode via Azure Key Vault; identity and vault come from repository variables.
+  # CODE_SIGN_EXPECTED_SUBJECT is optional and pins the publisher in the verify steps.
+  CODE_SIGN_CLIENT_ID: ${{ vars.CODE_SIGN_CLIENT_ID }}
+  CODE_SIGN_CERTIFICATE_NAME: ${{ vars.CODE_SIGN_CERTIFICATE_NAME }}
+  CODE_SIGN_KEY_VAULT_URL: ${{ vars.CODE_SIGN_KEY_VAULT_URL }}
+  CODE_SIGN_EXPECTED_SUBJECT: ${{ vars.CODE_SIGN_EXPECTED_SUBJECT }}
+  CODE_SIGN_TIMESTAMP_URL: http://timestamp.acs.microsoft.com
 
 jobs:
   build:
@@ -33,10 +40,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      # The runner executes as SYSTEM on every enrolling device — a parse error or
+      # The loader executes as SYSTEM on every enrolling device — a parse error or
       # non-ASCII mojibake (PS 5.1 codepage roulette) must fail the build, not the fleet.
+      # bootstrap-script-gates.yml runs the same checks plus Pester on pushes; this job
+      # stands on its own because it can be dispatched at any time.
       - name: Validate runner script (parse + ASCII-only)
         shell: pwsh
         run: |
@@ -62,8 +71,77 @@ jobs:
           Write-Host "MSI version (from Package.wxs): $version"
           "version=$version" >> $env:GITHUB_OUTPUT
 
+      # Every published MSI is signed; a missing variable stops the run before the build.
+      - name: Check code-signing configuration
+        shell: pwsh
+        run: |
+          foreach ($name in 'CODE_SIGN_CLIENT_ID', 'CODE_SIGN_CERTIFICATE_NAME', 'CODE_SIGN_KEY_VAULT_URL') {
+            if ([string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($name))) {
+              throw "Repository variable $name is not set. Every published MSI must be Authenticode-signed."
+            }
+          }
+
+      # Logs in FIRST and only to fetch the Key Vault token: azure/login sets the default az
+      # account, so the storage login below has to be the last one. Both federated credentials
+      # are bound to the ref, so this job must never be given an `environment:` -- that would
+      # change the OIDC subject claim and break both logins.
+      - name: Login to Azure (code-signing identity)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ env.CODE_SIGN_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          allow-no-subscriptions: true
+
+      - name: Acquire Key Vault token for signing
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $token = az account get-access-token --scope https://vault.azure.net/.default --query accessToken --output tsv
+          if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($token)) {
+            throw "Could not acquire a Key Vault token for the code-signing identity."
+          }
+          Write-Host "::add-mask::$token"
+          "CODE_SIGN_AKV_ACCESS_TOKEN=$token" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      # The blob upload below is authorized by this federated identity, not by a SAS.
+      - name: Login to Azure (OIDC)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      # Exact version, not a "5.*" range: wix writes the bytes of the MSI that customers
+      # install, so a compromised or simply broken point release must not flow into a build
+      # unnoticed. Bumping is a reviewed commit.
       - name: Install WiX toolset
-        run: dotnet tool install --global wix --version "5.*"
+        run: dotnet tool install --global wix --version 5.0.2
+
+      # Version pinned; roll-forward because the tool targets an older runtime than the SDK.
+      - name: Install AzureSignTool
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: dotnet tool install --no-cache --global AzureSignTool --version 7.0.1
+
+      # BEFORE the build: wix embeds the file as it finds it, so a loader signed afterwards
+      # would leave the copy inside the MSI unsigned. Devices under an AllSigned policy need
+      # the embedded loader to carry a signature of its own.
+      - name: Sign bootstrap loader (Authenticode)
+        shell: pwsh
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: |
+          $ErrorActionPreference = 'Stop'
+          & azuresigntool.exe sign --verbose `
+            --azure-key-vault-url "$env:CODE_SIGN_KEY_VAULT_URL" `
+            --azure-key-vault-accesstoken "$env:CODE_SIGN_AKV_ACCESS_TOKEN" `
+            --azure-key-vault-certificate "$env:CODE_SIGN_CERTIFICATE_NAME" `
+            --timestamp-rfc3161 "$env:CODE_SIGN_TIMESTAMP_URL" `
+            --file-digest sha256 `
+            --description 'Autopilot Monitor bootstrap runner' `
+            --description-url 'https://www.autopilotmonitor.com' `
+            $env:RUNNER_SCRIPT
+          if ($LASTEXITCODE -ne 0) { throw "azuresigntool failed with exit code $LASTEXITCODE" }
 
       - name: Build MSI
         shell: pwsh
@@ -75,16 +153,46 @@ jobs:
           wix build Package.wxs -arch x64 -o $out
           Pop-Location
           if (-not (Test-Path $env:STABLE_MSI)) { Write-Error "wix build produced no MSI"; exit 1 }
-          $sha256 = (Get-FileHash $env:STABLE_MSI -Algorithm SHA256).Hash.ToLowerInvariant()
           Write-Host "Built $env:STABLE_MSI ($([math]::Round((Get-Item $env:STABLE_MSI).Length / 1KB)) KB)"
-          Write-Host "SHA-256: $sha256"
+
+      # Signing rewrites the MSI, so it runs before the hash and the upload. A missing
+      # timestamp fails the run: without it the signature dies with the certificate.
+      - name: Sign MSI (Authenticode)
+        shell: pwsh
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: |
+          $ErrorActionPreference = 'Stop'
+          & azuresigntool.exe sign --verbose `
+            --azure-key-vault-url "$env:CODE_SIGN_KEY_VAULT_URL" `
+            --azure-key-vault-accesstoken "$env:CODE_SIGN_AKV_ACCESS_TOKEN" `
+            --azure-key-vault-certificate "$env:CODE_SIGN_CERTIFICATE_NAME" `
+            --timestamp-rfc3161 "$env:CODE_SIGN_TIMESTAMP_URL" `
+            --file-digest sha256 `
+            --description 'Autopilot Monitor Bootstrap' `
+            --description-url 'https://www.autopilotmonitor.com' `
+            $env:STABLE_MSI
+          if ($LASTEXITCODE -ne 0) { throw "azuresigntool failed with exit code $LASTEXITCODE" }
+
+          # The MSI and the loader it carries -- verified here, before anything is published.
+          foreach ($file in @($env:STABLE_MSI, $env:RUNNER_SCRIPT)) {
+            $sig = Get-AuthenticodeSignature -FilePath $file
+            if ($sig.Status -ne 'Valid') { throw "Signature on $file is '$($sig.Status)', expected 'Valid'." }
+            if (-not $sig.TimeStamperCertificate) { throw "Signature on $file carries no timestamp." }
+            if ($env:CODE_SIGN_EXPECTED_SUBJECT -and $sig.SignerCertificate.Subject -notlike $env:CODE_SIGN_EXPECTED_SUBJECT) {
+              throw "$file was signed by '$($sig.SignerCertificate.Subject)', expected '$env:CODE_SIGN_EXPECTED_SUBJECT'."
+            }
+            Write-Host "$file : Valid, timestamped, signer $($sig.SignerCertificate.Subject.Split(',')[0])"
+          }
+
+          Write-Host "SHA-256: $((Get-FileHash $env:STABLE_MSI -Algorithm SHA256).Hash.ToLowerInvariant())"
 
       - name: Upload to Azure Blob Storage
         if: inputs.upload_blob
         shell: pwsh
         run: |
           $containerUrl = "https://autopilotmonitoreu.blob.core.windows.net/agent"
-          $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}".TrimStart('?')
+          $authHeaders = & ./.github/scripts/Get-StorageAuthHeaders.ps1
           $version = "${{ steps.version.outputs.version }}"
 
           # Same Send-Blob contract as build-agent.yml: no-cache on every blob because the
@@ -102,7 +210,7 @@ jobs:
             $headers["Content-MD5"] = [Convert]::ToBase64String($md5.ComputeHash($bytes))
             $md5.Dispose()
             Write-Host "Uploading $BlobName ($([math]::Round($bytes.Length / 1KB)) KB)..."
-            Invoke-RestMethod -Uri "$containerUrl/$BlobName`?$sasToken" -Method Put -Headers $headers -Body $bytes
+            Invoke-RestMethod -Uri "$containerUrl/$BlobName" -Method Put -Headers ($authHeaders + $headers) -Body $bytes
             Write-Host "  uploaded $BlobName"
           }
 
@@ -125,15 +233,17 @@ jobs:
           }
           Write-Host "Alias verified: https://download.autopilotmonitor.com/agent/$env:STABLE_MSI ($remoteSize bytes)"
 
-      # Sigstore keyless provenance, same as the agent ZIP. Verify:
+      # Sigstore keyless provenance, same as the agent ZIP; covers the signed bytes. Skipped
+      # on runs that publish nothing -- no log entry for bytes nobody receives. Verify:
       # gh attestation verify AutopilotMonitor-Bootstrap.msi --repo okieselbach/AutopilotMonitor
       - name: Attest build provenance (MSI)
-        uses: actions/attest-build-provenance@v4
+        if: inputs.upload_blob
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
         with:
           subject-path: ${{ env.STABLE_MSI }}
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: AutopilotMonitor-Bootstrap-v${{ steps.version.outputs.version }}
           path: ${{ env.STABLE_MSI }}

.github/workflows/ci.yml

@@ -35,6 +35,7 @@ on:
       # Every other workflow: nothing here builds or tests anything CI covers. paths-ignore
       # cannot negate, so they are listed one by one; ci.yml itself stays out of the list
       # so a change to CI runs CI. A new workflow file is opt-in — add it here too.
+      - '.github/workflows/action-pins.yml'
       - '.github/workflows/bootstrap-script-gates.yml'
       - '.github/workflows/build-agent.yml'
       - '.github/workflows/build-msi.yml'
@@ -67,6 +68,7 @@ on:
       # Every other workflow: nothing here builds or tests anything CI covers. paths-ignore
       # cannot negate, so they are listed one by one; ci.yml itself stays out of the list
       # so a change to CI runs CI. A new workflow file is opt-in — add it here too.
+      - '.github/workflows/action-pins.yml'
       - '.github/workflows/bootstrap-script-gates.yml'
       - '.github/workflows/build-agent.yml'
       - '.github/workflows/build-msi.yml'
@@ -94,9 +96,9 @@ jobs:
     # windows-latest is required: the agent test projects target net48.
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         with:
           dotnet-version: '10.0.x'
 
@@ -125,9 +127,9 @@ jobs:
       run:
         working-directory: src/Web/autopilot-monitor-web
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
           cache: npm
@@ -159,9 +161,9 @@ jobs:
       run:
         working-directory: src/McpServer/autopilot-monitor-mcp
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
           cache: npm
@@ -179,7 +181,7 @@ jobs:
       # (run 31252869254). Persist the model across runs instead; HF_CACHE_DIR
       # is honored by vector-search-provider.ts.
       - name: Cache embedding model
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ${{ github.workspace }}/.hf-cache
           key: hf-model-Xenova-all-MiniLM-L6-v2
@@ -193,9 +195,9 @@ jobs:
     name: Generated guardrails match rules/guardrails.json
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
 
@@ -214,9 +216,9 @@ jobs:
     name: Generated wire types match shared-manifests.json
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
 

.github/workflows/codeql.yml

@@ -102,15 +102,15 @@ jobs:
             build-mode: none
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         if: matrix.language == 'csharp'
         with:
           dotnet-version: '10.0.x'
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.9
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -121,6 +121,6 @@ jobs:
         run: dotnet build AutopilotMonitor.sln --configuration Release
 
       - name: Analyze
-        uses: github/codeql-action/analyze@v4.37.9
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: /language:${{ matrix.language }}

.github/workflows/combine-rules.yml

@@ -24,14 +24,17 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
 
+      # Exact versions and no lifecycle scripts: this job holds contents:write and pushes to
+      # main, so an install-time script from a hijacked package would run with a token that
+      # can rewrite the repository. ajv is pure JS and needs no install hooks.
       - name: Install ajv-cli
-        run: npm install -g ajv-cli ajv-formats
+        run: npm install -g --ignore-scripts ajv-cli@5.0.0 ajv-formats@3.0.1
 
       - name: Validate Gather Rules
         run: |

.github/workflows/deploy-backend.yml

@@ -19,7 +19,7 @@ jobs:
     name: Build and Deploy Backend
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Login to Azure (OIDC)
         uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
@@ -29,7 +29,7 @@ jobs:
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       - name: Setup .NET 10
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         with:
           dotnet-version: '10.0.x'
 
@@ -41,7 +41,7 @@ jobs:
         id: version
         shell: pwsh
         run: |
-          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl "${{ env.VERSIONS_CONTAINER }}/backend.txt" -SasToken '${{ secrets.AZURE_BLOB_VERSIONS_SAS_TOKEN }}'
+          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl "${{ env.VERSIONS_CONTAINER }}/backend.txt"
 
           $csproj = Get-Content ${{ env.CSPROJ_PATH }} -Raw
           if ($csproj -notmatch '<VersionPrefix>(\d+\.\d+)</VersionPrefix>') {
@@ -115,9 +115,9 @@ jobs:
             runId       = '${{ github.run_id }}'
           } | ConvertTo-Json
 
-          $sas = '${{ secrets.AZURE_BLOB_VERSIONS_SAS_TOKEN }}'.TrimStart('?')
-          $url = "${{ env.VERSIONS_CONTAINER }}/backend.json?$sas"
+          $authHeaders = & ./.github/scripts/Get-StorageAuthHeaders.ps1
+          $url = "${{ env.VERSIONS_CONTAINER }}/backend.json"
           # no-cache: rotating pointer, must never be served stale by any fronting cache.
-          Invoke-RestMethod -Uri $url -Method Put -Headers @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' } -Body $manifest -ContentType 'application/json' | Out-Null
+          Invoke-RestMethod -Uri $url -Method Put -Headers ($authHeaders + @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' }) -Body $manifest -ContentType 'application/json' | Out-Null
           Write-Host "Published versions/backend.json"
           Write-Host $manifest

.github/workflows/deploy-mcp.yml

@@ -26,7 +26,7 @@ jobs:
     name: Build and Deploy MCP Server
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       # The published customer documentation lives in its own PUBLIC repo and is
       # baked into the image as the search_docs corpus (see the Dockerfile). No
@@ -36,7 +36,7 @@ jobs:
       # re-run actually rolls a new revision). /health reports the SHA captured
       # below so that staleness is checkable.
       - name: Check out documentation bundle
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: autopilotmonitor/autopilotmonitor-docs
           path: mcp-docs
@@ -59,7 +59,7 @@ jobs:
         id: version
         shell: pwsh
         run: |
-          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl "${{ env.VERSIONS_CONTAINER }}/mcp.txt" -SasToken '${{ secrets.AZURE_BLOB_VERSIONS_SAS_TOKEN }}'
+          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl "${{ env.VERSIONS_CONTAINER }}/mcp.txt"
 
           $pkgVersion = (Get-Content ${{ env.PACKAGE_JSON }} -Raw | ConvertFrom-Json).version
           $prefix = ($pkgVersion -split '\.')[0..1] -join '.'
@@ -144,9 +144,9 @@ jobs:
             docsCommit  = '${{ steps.docs.outputs.sha }}'.Substring(0, 7)
           } | ConvertTo-Json
 
-          $sas = '${{ secrets.AZURE_BLOB_VERSIONS_SAS_TOKEN }}'.TrimStart('?')
-          $url = "${{ env.VERSIONS_CONTAINER }}/mcp.json?$sas"
+          $authHeaders = & ./.github/scripts/Get-StorageAuthHeaders.ps1
+          $url = "${{ env.VERSIONS_CONTAINER }}/mcp.json"
           # no-cache: rotating pointer, must never be served stale by any fronting cache.
-          Invoke-RestMethod -Uri $url -Method Put -Headers @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' } -Body $manifest -ContentType 'application/json' | Out-Null
+          Invoke-RestMethod -Uri $url -Method Put -Headers ($authHeaders + @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' }) -Body $manifest -ContentType 'application/json' | Out-Null
           Write-Host "Published versions/mcp.json"
           Write-Host $manifest

.github/workflows/deploy-web.yml

@@ -35,12 +35,38 @@ jobs:
     runs-on: ubuntu-latest
     name: Build and Deploy Job
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           lfs: false
           fetch-depth: 0  # Full history needed for git-based sitemap lastmod dates
 
-      - uses: actions/setup-node@v7
+      # Only the version manifest at the very end needs Azure; logging in here rather than
+      # next to that step keeps a credential problem from surfacing after a live deploy.
+      - name: Login to Azure (OIDC)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      # The customer docs repo is the single source of the "What's new" panel: the prebuild
+      # step (scripts/whats-new/build-whats-new.js) turns changelog/*.md into
+      # public/whats-new.json and dates every bullet via git blame — hence the full history.
+      # Public repo, no token. Editing the docs does NOT update the live panel until this
+      # workflow runs again (push under src/Web/** or a manual dispatch); versions/web.json
+      # records which docs commit is live.
+      - name: Check out documentation bundle
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: autopilotmonitor/autopilotmonitor-docs
+          path: whats-new-docs
+          fetch-depth: 0
+
+      - name: Resolve docs commit
+        id: docs
+        run: echo "sha=$(git -C whats-new-docs rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
           cache: npm
@@ -51,7 +77,7 @@ jobs:
         run: npm ci
 
       # next.config output:'export' -- `next build` writes the static site to out/
-      # (prebuild: sync-error-codes, generate-lastmod, generate-version).
+      # (prebuild: sync-error-codes, generate-lastmod, generate-version, whats-new).
       - name: Build
         working-directory: ${{ env.WEB_DIR }}
         env:
@@ -68,9 +94,12 @@ jobs:
           # Build stamp for public/version.json (scripts/generate-version.js in prebuild);
           # the verify step below polls the deployed file for exactly this commit.
           GITHUB_SHA: ${{ github.sha }}
+          # Docs checkout for public/whats-new.json; the prebuild fails in CI without it.
+          WHATS_NEW_DOCS_DIR: ${{ github.workspace }}/whats-new-docs
         run: |
           npm run build
           test -f out/version.json || { echo "out/version.json missing - export did not run"; exit 1; }
+          test -f out/whats-new.json || { echo "out/whats-new.json missing - whats-new prebuild did not run"; exit 1; }
 
       # One archive of the exact bytes that get uploaded, so the attestation has a single subject.
       - name: Package export
@@ -85,12 +114,12 @@ jobs:
       # commit, workflow file) in a public transparency log.
       # Verify: gh attestation verify portal-<sha>.tar.gz --repo okieselbach/AutopilotMonitor
       - name: Attest build provenance (portal export)
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
         with:
           subject-path: ${{ steps.package.outputs.archive }}
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: portal-${{ github.sha }}
           path: ${{ steps.package.outputs.archive }}
@@ -136,7 +165,8 @@ jobs:
           throw "Portal did not serve commit $expectedCommit within 5 minutes -- deployment not verified, version manifest NOT published"
 
       # Cross-component deploy record, written last and only on a verified deploy --
-      # same contract as versions/backend.json and versions/mcp.json.
+      # same contract as versions/backend.json and versions/mcp.json. docsCommit says which
+      # docs revision the live What's new panel was generated from (as for the MCP corpus).
       - name: Publish version manifest
         shell: pwsh
         run: |
@@ -145,11 +175,12 @@ jobs:
             commit      = '${{ github.sha }}'.Substring(0, 7)
             deployedUtc = [DateTime]::UtcNow.ToString('o')
             runId       = '${{ github.run_id }}'
+            docsCommit  = '${{ steps.docs.outputs.sha }}'.Substring(0, 7)
           } | ConvertTo-Json
 
-          $sas = '${{ secrets.AZURE_BLOB_VERSIONS_SAS_TOKEN }}'.TrimStart('?')
-          $url = "${{ env.VERSIONS_CONTAINER }}/web.json?$sas"
+          $authHeaders = & ./.github/scripts/Get-StorageAuthHeaders.ps1
+          $url = "${{ env.VERSIONS_CONTAINER }}/web.json"
           # no-cache: rotating pointer, must never be served stale by any fronting cache.
-          Invoke-RestMethod -Uri $url -Method Put -Headers @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' } -Body $manifest -ContentType 'application/json' | Out-Null
+          Invoke-RestMethod -Uri $url -Method Put -Headers ($authHeaders + @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' }) -Body $manifest -ContentType 'application/json' | Out-Null
           Write-Host "Published versions/web.json"
           Write-Host $manifest

.github/workflows/publish-scripts.yml

@@ -26,6 +26,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write   # OIDC federated login for the storage writes (secret-less)
 
 # Shared with build-agent.yml: a script publish and an agent release both touch
 # version.json, and the bootstrapVersion read-modify-write must not interleave with the
@@ -34,6 +35,16 @@ concurrency:
   group: agent-blob-publish
   cancel-in-progress: false
 
+# Authenticode for the customer scripts. Same identity and same repository variables as
+# build-agent.yml -- the loader on every device pins this publisher, so the two must not
+# drift apart.
+env:
+  CODE_SIGN_CLIENT_ID: ${{ vars.CODE_SIGN_CLIENT_ID }}
+  CODE_SIGN_CERTIFICATE_NAME: ${{ vars.CODE_SIGN_CERTIFICATE_NAME }}
+  CODE_SIGN_KEY_VAULT_URL: ${{ vars.CODE_SIGN_KEY_VAULT_URL }}
+  CODE_SIGN_EXPECTED_SUBJECT: ${{ vars.CODE_SIGN_EXPECTED_SUBJECT }}
+  CODE_SIGN_TIMESTAMP_URL: http://timestamp.acs.microsoft.com
+
 jobs:
   gates:
     uses: ./.github/workflows/bootstrap-script-gates.yml
@@ -43,14 +54,81 @@ jobs:
     needs: gates
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Check code-signing configuration
+        shell: pwsh
+        run: |
+          foreach ($name in 'CODE_SIGN_CLIENT_ID', 'CODE_SIGN_CERTIFICATE_NAME', 'CODE_SIGN_KEY_VAULT_URL') {
+            if ([string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($name))) {
+              throw "Repository variable $name is not set. Published customer scripts must be signed."
+            }
+          }
+
+      # First, and only to fetch the Key Vault token: azure/login sets the default az
+      # account and the storage login below has to be the one that stays. See D-223 --
+      # both federated credentials are bound to the ref, so this job must never carry a
+      # GitHub `environment:`.
+      - name: Login to Azure (code-signing identity)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ env.CODE_SIGN_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          allow-no-subscriptions: true
+
+      - name: Acquire Key Vault token for signing
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $token = az account get-access-token --scope https://vault.azure.net/.default --query accessToken --output tsv
+          if ($LASTEXITCODE -ne 0 -or [string]::IsNullOrWhiteSpace($token)) {
+            throw "Could not acquire a Key Vault token for the code-signing identity."
+          }
+          Write-Host "::add-mask::$token"
+          "CODE_SIGN_AKV_ACCESS_TOKEN=$token" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      # Authorizes the eu blob writes and the AdminConfiguration merge. The gates job above
+      # runs the same publisher with -DryRun and deliberately without a login -- a dry run
+      # must never need Azure credentials.
+      - name: Login to Azure (OIDC)
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      # Version pinned so a new or compromised NuGet release cannot flow into signing
+      # unreviewed; roll-forward because the tool targets an older runtime than the SDK
+      # preinstalled on the runner.
+      - name: Install AzureSignTool
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
+        run: dotnet tool install --no-cache --global AzureSignTool --version 7.0.1
 
       - name: Publish bootstrap + customer scripts
         shell: pwsh
+        env:
+          DOTNET_ROLL_FORWARD: LatestMajor
         run: |
           $dryRun = '${{ inputs.dry_run }}' -eq 'true'
           ./.github/scripts/Publish-BootstrapScripts.ps1 `
-            -SasToken '${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}' `
             -LegacySasToken '${{ secrets.AZURE_BLOB_AGENT_LEGACY_SAS_TOKEN }}' `
-            -TableSasToken '${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}' `
+            -SigningToken $env:CODE_SIGN_AKV_ACCESS_TOKEN `
+            -KeyVaultUrl $env:CODE_SIGN_KEY_VAULT_URL `
+            -CertificateName $env:CODE_SIGN_CERTIFICATE_NAME `
+            -TimestampUrl $env:CODE_SIGN_TIMESTAMP_URL `
+            -ExpectedPublisher $env:CODE_SIGN_EXPECTED_SUBJECT `
+            -SignedOutputDir "$env:RUNNER_TEMP/signed-scripts" `
             -DryRun:$dryRun
+
+      # The exact bytes that were (or, on a dry run, would have been) uploaded. A dry-run
+      # dispatch is therefore the way to inspect a signed script locally before it reaches
+      # a single customer. Kept on failure too: a failed alias verification is precisely
+      # when someone wants to look at the file.
+      - name: Upload signed scripts
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: signed-scripts
+          path: ${{ runner.temp }}/signed-scripts
+          if-no-files-found: ignore

.gitignore

@@ -145,6 +145,10 @@ internal/docs/~$Introduction-AutopilotMonitor.pptx
 # changes each run) and served at /version.json from the static export.
 src/Web/autopilot-monitor-web/public/version.json
 
+# What's new payload: generated by scripts/whats-new/build-whats-new.js from the docs
+# checkout on every build and served at /whats-new.json from the static export.
+src/Web/autopilot-monitor-web/public/whats-new.json
+
 
 # Local IME installer scratch (MSI + extracted payload per version, for grepping
 # in binaries). Operator-only, never committed.

README.md

@@ -1,33 +1,63 @@
-# <img src=".github/assets/logo.svg" height="28" alt="" /> Autopilot Monitor
+# <img src=".github/assets/logo.svg" height="28" alt="Autopilot Monitor logo" /> Autopilot Monitor
 
 [![Status](https://img.shields.io/badge/status-live-brightgreen)](https://www.autopilotmonitor.com)
 [![License](https://img.shields.io/badge/license-MIT%20%2B%20AGPL--3.0-blue)](LICENSE)
 [![Website](https://img.shields.io/badge/website-autopilotmonitor.com-2ea44f)](https://www.autopilotmonitor.com)
 
-Advanced monitoring and troubleshooting solution for Windows Autopilot deployments. Gain full visibility into every enrollment session with a detailed event timeline, fleet health dashboards, and session reporting. Define custom analysis rules to automatically detect issues and gather rules to collect targeted evidence. Retrieve diagnostics packages on demand, configure agent settings like auto-reboot behavior and automatic timezone adjustment — all managed centrally from the web dashboard.
+Autopilot Monitor is an open-source, real-time monitoring and troubleshooting platform for **Windows Autopilot** and **Microsoft Intune** enrollment. It records enrollment events, application installations, policies, device state, and diagnostics while provisioning is still running, instead of collecting logs by hand after a failure. Administrators get live enrollment tracking, Enrollment Status Page (ESP) visibility, detailed session timelines, automated issue detection, on-demand diagnostics, fleet health analytics, and AI-assisted troubleshooting through a hosted Model Context Protocol (MCP) server.
+
+The platform supports classic Windows Autopilot and modern Intune provisioning scenarios, including **Windows Autopilot Device Preparation**.
 
 ## Availability
 
 Autopilot Monitor is **publicly available** — the Community plan is free. Sign in with your work account at **[autopilotmonitor.com](https://www.autopilotmonitor.com)**; new organizations complete a short activation step after first sign-in.
 
 <p align="center">
-  <img src=".github/assets/SessionList.png" width="45%" />
-  <img src=".github/assets/FleetHealth.png" width="45%" />
+  <img src=".github/assets/SessionList.png" width="45%" alt="Autopilot Monitor dashboard showing live Windows Autopilot and Intune enrollment sessions" />
+  <img src=".github/assets/FleetHealth.png" width="45%" alt="Autopilot Monitor fleet health dashboard with Windows Autopilot enrollment analytics and success metrics" />
 </p>
 <p align="center">
-  <img src=".github/assets/SessionDetails.png" width="45%" />
-  <img src=".github/assets/SessionTimeline.png" width="45%" />
+  <img src=".github/assets/SessionDetails.png" width="45%" alt="Autopilot Monitor session details showing device information, diagnostics, apps, policies, and enrollment status" />
+  <img src=".github/assets/SessionTimeline.png" width="45%" alt="Windows Autopilot enrollment timeline showing ESP phases, application installs, policies, events, and errors" />
 </p>
 
-## Overview
+## Key Features
 
-Autopilot Monitor provides real-time tracking, intelligent diagnostics, and automated troubleshooting for Windows Autopilot enrollment processes. It consists of:
+- **Real-time Windows Autopilot monitoring** — follow device provisioning while enrollment is still running
+- **Detailed enrollment timelines** — correlate Autopilot, ESP, Intune Management Extension, apps, policies, device state, and system events
+- **Enrollment Status Page visibility** — see which phase, application, or policy is delaying provisioning
+- **Automated issue detection** — define custom analysis rules that identify known failure patterns
+- **Targeted evidence collection** — gather registry values, event log entries, files, log-parser matches, and allow-listed commands when specific conditions are detected
+- **On-demand diagnostics** — request diagnostics packages from enrolled devices remotely
+- **Fleet health analytics** — success rates, deployment duration, device models, applications, errors, and recurring issues
+- **Session reporting** — inspect and share detailed enrollment information for individual devices
+- **Windows Autopilot Device Preparation support** — monitor Device Preparation deployments alongside classic Autopilot scenarios
+- **Centralized agent configuration** — control diagnostic behavior, automatic reboots, timezone adjustment, and other monitoring settings from the web dashboard
+- **AI-assisted troubleshooting** — query enrollment data through the built-in Model Context Protocol server
 
-- **Bootstrap Script** — PowerShell script deployed via Intune that starts monitoring early in the enrollment process
-- **Monitoring Agent** — Lightweight .NET application that collects telemetry and evidence during enrollment
+## How it works
+
+Autopilot Monitor consists of several components working together throughout Windows enrollment:
+
+- **Bootstrap Script** — PowerShell script deployed through Microsoft Intune that starts monitoring early in the provisioning process
+- **Monitoring Agent** — lightweight .NET application that collects telemetry and evidence during enrollment
 - **Backend API** — Azure Functions-based ingestion and processing pipeline
-- **Web Dashboard** — Next.js application for real-time monitoring and fleet analytics
-- **MCP Server** — Model Context Protocol server that lets AI assistants query and troubleshoot enrollments in natural language
+- **Web Dashboard** — Next.js application for real-time monitoring, troubleshooting, and fleet analytics
+- **MCP Server** — Model Context Protocol server that lets AI assistants query Autopilot Monitor data in natural language
+
+## Windows Autopilot and Intune Troubleshooting
+
+Autopilot Monitor helps investigate common Windows provisioning and enrollment problems such as:
+
+- Windows Autopilot deployments that fail or appear stuck
+- Enrollment Status Page (ESP) delays and unusually long deployment phases
+- Win32 application installation failures and slow application downloads
+- Intune Management Extension problems
+- Microsoft Entra join, Hybrid Join, and device registration issues
+- policies that block or delay provisioning
+- inconsistent behavior across hardware models and recurring failures affecting multiple devices
+
+Because telemetry is collected during enrollment, many problems can be investigated without reproducing the issue or manually collecting logs from the affected device.
 
 ## AI Integration (MCP)
 
@@ -35,13 +65,19 @@ Autopilot Monitor ships a hosted **[Model Context Protocol](https://modelcontext
 
 - *"Show me all failed enrollments from the last 24 hours and group them by failure reason."*
 - *"Why did session X fail, and which app install caused the delay?"*
+- *"Which devices had unusually long ESP application phases this week?"*
+- *"Which device models have the highest Autopilot failure rate?"*
 - *"Which devices in my fleet are affected by CVE-2024-30078?"*
 
-Server URL: `https://mcp.autopilotmonitor.com/mcp` — sign-in runs through your existing work account, access is scoped to your tenant exactly like in the portal, and no credentials are stored. Setup guide: **[AI Integration (MCP)](https://docs.autopilotmonitor.com/integrations/ai-integration-mcp)**.
+Server URL: `https://mcp.autopilotmonitor.com/mcp` — sign-in runs through your existing work account, access is scoped to your tenant exactly like in the portal, and the MCP server stores no credentials. Setup guide: **[AI Integration (MCP)](https://docs.autopilotmonitor.com/integrations/ai-integration-mcp)**.
 
 ## Documentation
 
-Full admin documentation is available at **[docs.autopilotmonitor.com](https://docs.autopilotmonitor.com)**
+Full admin documentation is available at **[docs.autopilotmonitor.com](https://docs.autopilotmonitor.com)** — deployment, configuration, monitoring, diagnostics, troubleshooting, analysis and gather rules, integrations, and AI-assisted troubleshooting.
+
+## Open Source
+
+Autopilot Monitor is developed openly on GitHub. The source is published so that customers and security reviewers can see what runs on their devices and with their data: the repository contains the device agent, shared library, backend, web dashboard, and MCP server.
 
 ## Feedback
 

rules/analyze/ANALYZE-APP-014.json

@@ -5,7 +5,7 @@
   "description": "Detects when the Enrollment Status Page failed on the Apps subcategory and the agent's AppX deployment log scan identified a suspected MSIX/Store package. Store/MSIX apps install outside the Win32 pipeline, so the regular per-app tracking sees nothing — this correlation names the likely culprit.",
   "severity": "warning",
   "category": "apps",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "enabled": true,
   "evaluateOn": [
     "enrollment_end",
@@ -93,7 +93,7 @@
       "steps": [
         "Open Event Viewer → Applications and Services Logs → Microsoft → Windows → AppXDeploymentServer → Operational on the device (or in the diagnostics archive if uploaded)",
         "Filter for Error-level events around the ESP failure time and confirm the package name and HRESULT match this finding",
-        "Look up the HRESULT: 0x80073cf9 = generic install failure, 0x80073cf0 = invalid/corrupt package, 0x80073cff = sideloading/licensing policy block, 0x80073d02 = blocked because app is in use"
+        "Look up the HRESULT: 0x80073cf9 = generic install failure, 0x80073cf0 = package could not be opened (unsigned, publisher mismatch, or not found), 0x80073cff = sideloading/licensing policy block, 0x80073d02 = blocked because app is in use"
       ]
     },
     {

rules/analyze/ANALYZE-APP-018.json

@@ -0,0 +1,98 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-APP-018",
+  "title": "App Return Code Requested a Reboot During Enrollment",
+  "description": "Detects Win32 apps whose installer exit code maps to Soft reboot or Hard reboot in the app's Intune return-code table (the '[Win32App] lpExitCode is defined as ...' line). Hard reboot stops app processing and restarts the device in Device Setup - the mid-enrollment restart and second sign-in; Soft reboot leaves the app pending until the next restart while the ESP moves on. Confidence rises for Hard reboot and when a reboot was actually observed in the session.",
+  "severity": "warning",
+  "category": "apps",
+  "version": "1.0.0",
+  "author": "Autopilot Monitor",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
+  "trigger": "single",
+  "baseConfidence": 60,
+  "conditions": [
+    {
+      "signal": "reboot_return_code",
+      "source": "event_data",
+      "eventType": "app_install_completed",
+      "dataField": "exitCodeClass",
+      "operator": "in",
+      "value": "SoftReboot,HardReboot",
+      "required": true
+    },
+    {
+      "signal": "hard_reboot_return_code",
+      "source": "event_data",
+      "eventType": "app_install_completed",
+      "dataField": "exitCodeClass",
+      "operator": "equals",
+      "value": "HardReboot",
+      "required": false
+    },
+    {
+      "signal": "reboot_observed",
+      "source": "event_count",
+      "eventType": "system_reboot_detected",
+      "operator": "count_gte",
+      "value": "1",
+      "required": false
+    }
+  ],
+  "confidenceFactors": [
+    {
+      "signal": "hard_reboot_return_code",
+      "condition": "exists",
+      "weight": 25
+    },
+    {
+      "signal": "reboot_observed",
+      "condition": "exists",
+      "weight": 15
+    }
+  ],
+  "confidenceThreshold": 60,
+  "explanation": "App **{{appName}}** returned exit code **{{exitCode}}**, which its Intune return-code table maps to **{{exitCodeClass}}** - the installer asked for a restart before its work is complete.\n\n- **SoftReboot**: the Intune Management Extension reports the app as *pending reboot*. The Enrollment Status Page treats it as completed and moves on, and Intune only marks the app installed after the next restart re-evaluates the detection rule. Until then the app may be unusable or half-configured, and the user sees a restart notification.\n- **HardReboot**: the Intune Management Extension stops processing further apps and, in Device Setup, restarts the device right away (the restart grace period does not apply during the ESP) - the same mid-enrollment restart and second sign-in that ANALYZE-ESP-005 attributes to reboot-required policies. In Account Setup the extension does not restart the device itself and the app stays pending.\n\nA restart requested by an installer is normal for many MSI packages (exit codes 3010 and 1641), but during Autopilot it lengthens the ESP, can surprise the user with a restart, and hides the app's real state until after the reboot. The return-code class is the app's own configuration in Intune, not a device fault.",
+  "remediation": [
+    {
+      "title": "Check the app's return-code mapping",
+      "steps": [
+        "Open the app in the Intune admin center > Properties > Program and review the return codes table: exit code {{exitCode}} is currently mapped to {{exitCodeClass}}",
+        "If the installer only recommends a restart (MSI 3010 ERROR_SUCCESS_REBOOT_REQUIRED, 1641 ERROR_SUCCESS_REBOOT_INITIATED), map the code to Soft reboot instead of Hard reboot so the next app can install before the restart",
+        "If the app works without an immediate restart, suppress the installer's own reboot (for MSI: REBOOT=ReallySuppress on the install command) so it returns 0 and the restart happens on your schedule",
+        "Keep Hard reboot only when the following apps genuinely cannot install before the restart - and then expect the mid-ESP restart in every enrollment"
+      ]
+    },
+    {
+      "title": "Take the app out of the ESP critical path",
+      "steps": [
+        "If the app is not needed for first use, remove it from the ESP blocking-app list so the restart happens after the user reaches the desktop",
+        "If it must stay blocking, order it last in Device Setup (dependencies or install order) so a hard reboot does not interrupt the remaining apps",
+        "For Soft reboot apps, plan a restart at the end of enrollment or accept that the app finishes on the user's first restart"
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: Add a Win32 app - Program step (device restart behavior and return codes)",
+      "url": "https://learn.microsoft.com/en-us/intune/app-management/deployment/add-win32#step-2-program"
+    },
+    {
+      "title": "Microsoft Learn: Enrollment Status Page tracking",
+      "url": "https://learn.microsoft.com/en-us/autopilot/enrollment-status"
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "apps",
+    "reboot",
+    "return-code",
+    "soft-reboot",
+    "hard-reboot",
+    "esp",
+    "second-sign-in"
+  ]
+}

rules/analyze/ANALYZE-ESP-004.json

@@ -1,11 +1,11 @@
 {
   "$schema": "../schema/analyze-rule.schema.json",
   "ruleId": "ANALYZE-ESP-004",
-  "title": "ESP Timeout with 'Continue Anyway' (Soft Failure)",
-  "description": "Detects an ESP terminal failure on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device.",
+  "title": "ESP Gave Up on a Blocking App with 'Continue Anyway' (Soft Failure)",
+  "description": "Detects an ESP terminal failure where the ESP gave up while a blocking app was still installing (the agent's own esp_apps_timeout verdict — no per-app HRESULT was reported) on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device. An ESP failure that carries a specific error code (a failed installer, a detection mismatch) is a different case and stays with the rule that explains that code.",
   "severity": "warning",
   "category": "esp",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "enabled": true,
   "baseConfidence": 80,
   "conditions": [
@@ -26,6 +26,27 @@
       "value": "true",
       "required": true
     },
+    {
+      "signal": "esp_gave_up_on_app",
+      "source": "event_type",
+      "eventType": "app_install_failed",
+      "dataField": "failureType",
+      "operator": "equals",
+      "value": "esp_apps_timeout",
+      "required": true
+    },
+    {
+      "signal": "appName",
+      "source": "event_data",
+      "eventType": "app_install_failed",
+      "dataField": "appName",
+      "operator": "exists",
+      "value": "",
+      "filterField": "failureType",
+      "filterOperator": "equals",
+      "filterValue": "esp_apps_timeout",
+      "required": false
+    },
     {
       "signal": "espSyncFailureTimeoutMinutes",
       "source": "event_type",
@@ -38,34 +59,25 @@
     {
       "signal": "failedSubcategory",
       "source": "event_type",
-      "eventType": "enrollment_failed",
+      "eventType": "esp_failure_settle_started",
       "dataField": "failedSubcategory",
       "operator": "exists",
       "value": "",
       "required": false
-    },
-    {
-      "signal": "appName",
-      "source": "event_type",
-      "eventType": "app_install_failed",
-      "dataField": "appName",
-      "operator": "exists",
-      "value": "",
-      "required": false
     }
   ],
   "confidenceFactors": [
-    { "signal": "appName", "condition": "exists", "weight": 10 }
+    { "signal": "failedSubcategory", "condition": "exists", "weight": 10 }
   ],
-  "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page reached its configured terminal timeout (`{{espSyncFailureTimeoutMinutes}} min`) before all blocking items finished. The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while at least one blocking item (`{{failedSubcategory}}` subcategory / app `{{appName}}`) did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP timeout wall, not at broken devices. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session (e.g. a certificate-only failure has no failed app).",
+  "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page gave up while the blocking app **{{appName}}** was still installing — the agent recorded no per-app error code, only that the app never finished inside the ESP window (the profile's configured limit is `{{espSyncFailureTimeoutMinutes}} min`; the ESP may have stopped earlier than that). The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while the `{{failedSubcategory}}` subcategory did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP limit, not at broken devices. This rule deliberately stays silent when the failed app reported a specific error code — a failed installer or a detection mismatch is explained by the rule for that code, and 'Continue anyway' does not make it a timing problem. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session.",
   "remediation": [
     {
       "title": "Relieve ESP pressure so enrollments finish inside the window",
       "steps": [
-        "Identify the slow blocking app (`{{appName}}`) and either remove it from the ESP 'block device use until these required apps are installed' list, or raise the ESP installation timeout (currently {{espSyncFailureTimeoutMinutes}} min).",
-        "If the app legitimately needs longer than the ESP allows, make it non-blocking and let it install after the desktop arrives.",
-        "Verify the app's detection rule matches after install — an app that installs but fails detection times out the ESP on every device (see ANALYZE-APP-013).",
-        "If a subcategory such as Certificates is reported under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
+        "Look at how long `{{appName}}` takes on a device that completes: if it legitimately needs longer than the ESP allows, make it non-blocking (remove it from 'block device use until these required apps are installed') and let it install after the desktop arrives.",
+        "If the app must stay blocking, raise the ESP setting 'Show error when installation takes longer than' (configured at {{espSyncFailureTimeoutMinutes}} min) — a limit, not a target; it only helps when the app reliably finishes within the new value.",
+        "Check the app's dependencies and install order: a blocking app waiting on a large dependency download (Delivery Optimization, proxy throughput) is the usual reason it never finishes in time.",
+        "If the ESP reported a non-Apps subcategory under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
       ]
     }
   ],

rules/analyze/ANALYZE-ID-001.json

@@ -5,6 +5,7 @@
   "description": "Detects when a certificate with the configured subject is missing from the local machine personal store (LocalMachine\\My). Requires the gather rule GATHER-ID-002 (machine cert store inventory) to be enabled — the check runs against its gather_machine_cert_store output. A missing certificate may indicate that MDM enrollment certificate provisioning or SCEP certificate deployment failed.",
   "severity": "warning",
   "category": "identity",
+  "author": "Community",
   "isCommunity": true,
   "enabled": false,
   "evaluateOn": [

rules/dist/analyze-rules.json

@@ -615,7 +615,7 @@
       "description": "Detects when the Enrollment Status Page failed on the Apps subcategory and the agent's AppX deployment log scan identified a suspected MSIX/Store package. Store/MSIX apps install outside the Win32 pipeline, so the regular per-app tracking sees nothing — this correlation names the likely culprit.",
       "severity": "warning",
       "category": "apps",
-      "version": "1.2.0",
+      "version": "1.2.1",
       "enabled": true,
       "evaluateOn": [
         "enrollment_end",
@@ -703,7 +703,7 @@
           "steps": [
             "Open Event Viewer → Applications and Services Logs → Microsoft → Windows → AppXDeploymentServer → Operational on the device (or in the diagnostics archive if uploaded)",
             "Filter for Error-level events around the ESP failure time and confirm the package name and HRESULT match this finding",
-            "Look up the HRESULT: 0x80073cf9 = generic install failure, 0x80073cf0 = invalid/corrupt package, 0x80073cff = sideloading/licensing policy block, 0x80073d02 = blocked because app is in use"
+            "Look up the HRESULT: 0x80073cf9 = generic install failure, 0x80073cf0 = package could not be opened (unsigned, publisher mismatch, or not found), 0x80073cff = sideloading/licensing policy block, 0x80073d02 = blocked because app is in use"
           ]
         },
         {
@@ -1034,6 +1034,103 @@
         "esp"
       ]
     },
+    {
+      "ruleId": "ANALYZE-APP-018",
+      "title": "App Return Code Requested a Reboot During Enrollment",
+      "description": "Detects Win32 apps whose installer exit code maps to Soft reboot or Hard reboot in the app's Intune return-code table (the '[Win32App] lpExitCode is defined as ...' line). Hard reboot stops app processing and restarts the device in Device Setup - the mid-enrollment restart and second sign-in; Soft reboot leaves the app pending until the next restart while the ESP moves on. Confidence rises for Hard reboot and when a reboot was actually observed in the session.",
+      "severity": "warning",
+      "category": "apps",
+      "version": "1.0.0",
+      "author": "Autopilot Monitor",
+      "enabled": true,
+      "evaluateOn": [
+        "enrollment_end",
+        "whiteglove_sealed"
+      ],
+      "trigger": "single",
+      "baseConfidence": 60,
+      "conditions": [
+        {
+          "signal": "reboot_return_code",
+          "source": "event_data",
+          "eventType": "app_install_completed",
+          "dataField": "exitCodeClass",
+          "operator": "in",
+          "value": "SoftReboot,HardReboot",
+          "required": true
+        },
+        {
+          "signal": "hard_reboot_return_code",
+          "source": "event_data",
+          "eventType": "app_install_completed",
+          "dataField": "exitCodeClass",
+          "operator": "equals",
+          "value": "HardReboot",
+          "required": false
+        },
+        {
+          "signal": "reboot_observed",
+          "source": "event_count",
+          "eventType": "system_reboot_detected",
+          "operator": "count_gte",
+          "value": "1",
+          "required": false
+        }
+      ],
+      "confidenceFactors": [
+        {
+          "signal": "hard_reboot_return_code",
+          "condition": "exists",
+          "weight": 25
+        },
+        {
+          "signal": "reboot_observed",
+          "condition": "exists",
+          "weight": 15
+        }
+      ],
+      "confidenceThreshold": 60,
+      "explanation": "App **{{appName}}** returned exit code **{{exitCode}}**, which its Intune return-code table maps to **{{exitCodeClass}}** - the installer asked for a restart before its work is complete.\n\n- **SoftReboot**: the Intune Management Extension reports the app as *pending reboot*. The Enrollment Status Page treats it as completed and moves on, and Intune only marks the app installed after the next restart re-evaluates the detection rule. Until then the app may be unusable or half-configured, and the user sees a restart notification.\n- **HardReboot**: the Intune Management Extension stops processing further apps and, in Device Setup, restarts the device right away (the restart grace period does not apply during the ESP) - the same mid-enrollment restart and second sign-in that ANALYZE-ESP-005 attributes to reboot-required policies. In Account Setup the extension does not restart the device itself and the app stays pending.\n\nA restart requested by an installer is normal for many MSI packages (exit codes 3010 and 1641), but during Autopilot it lengthens the ESP, can surprise the user with a restart, and hides the app's real state until after the reboot. The return-code class is the app's own configuration in Intune, not a device fault.",
+      "remediation": [
+        {
+          "title": "Check the app's return-code mapping",
+          "steps": [
+            "Open the app in the Intune admin center > Properties > Program and review the return codes table: exit code {{exitCode}} is currently mapped to {{exitCodeClass}}",
+            "If the installer only recommends a restart (MSI 3010 ERROR_SUCCESS_REBOOT_REQUIRED, 1641 ERROR_SUCCESS_REBOOT_INITIATED), map the code to Soft reboot instead of Hard reboot so the next app can install before the restart",
+            "If the app works without an immediate restart, suppress the installer's own reboot (for MSI: REBOOT=ReallySuppress on the install command) so it returns 0 and the restart happens on your schedule",
+            "Keep Hard reboot only when the following apps genuinely cannot install before the restart - and then expect the mid-ESP restart in every enrollment"
+          ]
+        },
+        {
+          "title": "Take the app out of the ESP critical path",
+          "steps": [
+            "If the app is not needed for first use, remove it from the ESP blocking-app list so the restart happens after the user reaches the desktop",
+            "If it must stay blocking, order it last in Device Setup (dependencies or install order) so a hard reboot does not interrupt the remaining apps",
+            "For Soft reboot apps, plan a restart at the end of enrollment or accept that the app finishes on the user's first restart"
+          ]
+        }
+      ],
+      "relatedDocs": [
+        {
+          "title": "Microsoft Learn: Add a Win32 app - Program step (device restart behavior and return codes)",
+          "url": "https://learn.microsoft.com/en-us/intune/app-management/deployment/add-win32#step-2-program"
+        },
+        {
+          "title": "Microsoft Learn: Enrollment Status Page tracking",
+          "url": "https://learn.microsoft.com/en-us/autopilot/enrollment-status"
+        }
+      ],
+      "markSessionAsFailedDefault": false,
+      "tags": [
+        "apps",
+        "reboot",
+        "return-code",
+        "soft-reboot",
+        "hard-reboot",
+        "esp",
+        "second-sign-in"
+      ]
+    },
     {
       "ruleId": "ANALYZE-CORR-003",
       "title": "Proxy Configuration Causing Download Failure",
@@ -2399,11 +2496,11 @@
     },
     {
       "ruleId": "ANALYZE-ESP-004",
-      "title": "ESP Timeout with 'Continue Anyway' (Soft Failure)",
-      "description": "Detects an ESP terminal failure on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device.",
+      "title": "ESP Gave Up on a Blocking App with 'Continue Anyway' (Soft Failure)",
+      "description": "Detects an ESP terminal failure where the ESP gave up while a blocking app was still installing (the agent's own esp_apps_timeout verdict — no per-app HRESULT was reported) on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device. An ESP failure that carries a specific error code (a failed installer, a detection mismatch) is a different case and stays with the rule that explains that code.",
       "severity": "warning",
       "category": "esp",
-      "version": "1.0.1",
+      "version": "1.1.0",
       "enabled": true,
       "baseConfidence": 80,
       "conditions": [
@@ -2424,6 +2521,27 @@
           "value": "true",
           "required": true
         },
+        {
+          "signal": "esp_gave_up_on_app",
+          "source": "event_type",
+          "eventType": "app_install_failed",
+          "dataField": "failureType",
+          "operator": "equals",
+          "value": "esp_apps_timeout",
+          "required": true
+        },
+        {
+          "signal": "appName",
+          "source": "event_data",
+          "eventType": "app_install_failed",
+          "dataField": "appName",
+          "operator": "exists",
+          "value": "",
+          "filterField": "failureType",
+          "filterOperator": "equals",
+          "filterValue": "esp_apps_timeout",
+          "required": false
+        },
         {
           "signal": "espSyncFailureTimeoutMinutes",
           "source": "event_type",
@@ -2436,38 +2554,29 @@
         {
           "signal": "failedSubcategory",
           "source": "event_type",
-          "eventType": "enrollment_failed",
+          "eventType": "esp_failure_settle_started",
           "dataField": "failedSubcategory",
           "operator": "exists",
           "value": "",
           "required": false
-        },
-        {
-          "signal": "appName",
-          "source": "event_type",
-          "eventType": "app_install_failed",
-          "dataField": "appName",
-          "operator": "exists",
-          "value": "",
-          "required": false
         }
       ],
       "confidenceFactors": [
         {
-          "signal": "appName",
+          "signal": "failedSubcategory",
           "condition": "exists",
           "weight": 10
         }
       ],
-      "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page reached its configured terminal timeout (`{{espSyncFailureTimeoutMinutes}} min`) before all blocking items finished. The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while at least one blocking item (`{{failedSubcategory}}` subcategory / app `{{appName}}`) did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP timeout wall, not at broken devices. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session (e.g. a certificate-only failure has no failed app).",
+      "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page gave up while the blocking app **{{appName}}** was still installing — the agent recorded no per-app error code, only that the app never finished inside the ESP window (the profile's configured limit is `{{espSyncFailureTimeoutMinutes}} min`; the ESP may have stopped earlier than that). The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while the `{{failedSubcategory}}` subcategory did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP limit, not at broken devices. This rule deliberately stays silent when the failed app reported a specific error code — a failed installer or a detection mismatch is explained by the rule for that code, and 'Continue anyway' does not make it a timing problem. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session.",
       "remediation": [
         {
           "title": "Relieve ESP pressure so enrollments finish inside the window",
           "steps": [
-            "Identify the slow blocking app (`{{appName}}`) and either remove it from the ESP 'block device use until these required apps are installed' list, or raise the ESP installation timeout (currently {{espSyncFailureTimeoutMinutes}} min).",
-            "If the app legitimately needs longer than the ESP allows, make it non-blocking and let it install after the desktop arrives.",
-            "Verify the app's detection rule matches after install — an app that installs but fails detection times out the ESP on every device (see ANALYZE-APP-013).",
-            "If a subcategory such as Certificates is reported under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
+            "Look at how long `{{appName}}` takes on a device that completes: if it legitimately needs longer than the ESP allows, make it non-blocking (remove it from 'block device use until these required apps are installed') and let it install after the desktop arrives.",
+            "If the app must stay blocking, raise the ESP setting 'Show error when installation takes longer than' (configured at {{espSyncFailureTimeoutMinutes}} min) — a limit, not a target; it only helps when the app reliably finishes within the new value.",
+            "Check the app's dependencies and install order: a blocking app waiting on a large dependency download (Delivery Optimization, proxy throughput) is the usual reason it never finishes in time.",
+            "If the ESP reported a non-Apps subcategory under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
           ]
         }
       ],
@@ -2697,6 +2806,7 @@
       "description": "Detects when a certificate with the configured subject is missing from the local machine personal store (LocalMachine\\My). Requires the gather rule GATHER-ID-002 (machine cert store inventory) to be enabled — the check runs against its gather_machine_cert_store output. A missing certificate may indicate that MDM enrollment certificate provisioning or SCEP certificate deployment failed.",
       "severity": "warning",
       "category": "identity",
+      "author": "Community",
       "isCommunity": true,
       "enabled": false,
       "evaluateOn": [

rules/dist/ime-log-patterns.json

@@ -339,6 +339,17 @@
       "description": "Captures the installer exit code (lpExitCode) for the current app.",
       "enabled": true
     },
+    {
+      "patternId": "IME-EXITCODE-CLASS",
+      "category": "currentPhase",
+      "pattern": "^\\[Win32App\\] lpExitCode is defined as (?<exitCodeClass>Success|SoftReboot|HardReboot|Retry|Failed)$",
+      "action": "captureExitCodeClass",
+      "parameters": {
+        "useCurrentApp": "true"
+      },
+      "description": "Captures the admin-defined return-code class of the installer exit code for the current app ('[Win32App] lpExitCode is defined as <Failed|Success|SoftReboot|HardReboot|Retry>', Win32AppInstaller.cs, enum AppReturnCodeType - literal identical from IME 1.50 through 1.105). Stored as exitCodeClass on the app and emitted on its terminal events; the last value wins, so a Retry loop that ends in Success reports Success. Anchored on both ends on purpose: the no-mapping warning ('... defined as <n>, fall into default now.') and an unparsable numeric type print a raw number and must not match. Companion of IME-EXITCODE (the number, logged just before) and IME-EXITCODE-MAPPED-FAILED (the Failed state transition), which still owns the error path.",
+      "enabled": true
+    },
     {
       "patternId": "IME-EXITCODE-MAPPED-FAILED",
       "category": "currentPhase",

rules/guardrails.json

@@ -94,7 +94,11 @@
     "C:\\Windows\\Panther",
     "C:\\Windows\\SetupDiag",
     "C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
-    "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log"
+    "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
+    "C:\\ProgramData\\RealmJoin\\choco\\logs"
+  ],
+  "userProfileFilePrefixes": [
+    "AppData\\Local\\RealmJoin"
   ],
   "wmiQueryPrefixes": [
     "SELECT * FROM Win32_OperatingSystem",
@@ -282,5 +286,25 @@
     "log_entry",
     "agent_trace",
     "stall_probe_check"
+  ],
+  "imeLogDerivedEventTypes": [
+    "app_install_started",
+    "app_install_completed",
+    "app_install_failed",
+    "app_install_skipped",
+    "app_download_started",
+    "app_tracking_summary",
+    "download_progress",
+    "do_telemetry",
+    "script_started",
+    "script_completed",
+    "script_failed",
+    "script_timeout_suspected",
+    "esp_phase_changed",
+    "ime_agent_version",
+    "ime_token_failure",
+    "ime_user_session_completed",
+    "ime_process_exited",
+    "ime_user_token_acquired"
   ]
 }

rules/ime-log-patterns/IME-EXITCODE-CLASS.json

@@ -0,0 +1,10 @@
+{
+  "$schema": "../schema/ime-log-pattern.schema.json",
+  "patternId": "IME-EXITCODE-CLASS",
+  "category": "currentPhase",
+  "pattern": "^\\[Win32App\\] lpExitCode is defined as (?<exitCodeClass>Success|SoftReboot|HardReboot|Retry|Failed)$",
+  "action": "captureExitCodeClass",
+  "parameters": { "useCurrentApp": "true" },
+  "description": "Captures the admin-defined return-code class of the installer exit code for the current app ('[Win32App] lpExitCode is defined as <Failed|Success|SoftReboot|HardReboot|Retry>', Win32AppInstaller.cs, enum AppReturnCodeType - literal identical from IME 1.50 through 1.105). Stored as exitCodeClass on the app and emitted on its terminal events; the last value wins, so a Retry loop that ends in Success reports Success. Anchored on both ends on purpose: the no-mapping warning ('... defined as <n>, fall into default now.') and an unparsable numeric type print a raw number and must not match. Companion of IME-EXITCODE (the number, logged just before) and IME-EXITCODE-MAPPED-FAILED (the Failed state transition), which still owns the error path.",
+  "enabled": true
+}

rules/schema/analyze-rule.schema.json

@@ -168,7 +168,7 @@
         },
         "source": {
           "type": "string",
-          "description": "Source of the signal. phase_duration and app_install_duration never derive a duration from an IME-log timestamp whose sourceOffsetOrigin is reader-zone-fallback (writer timezone unknown to the agent): such a condition evaluates false with evidence timestampProvenance=reader-zone-fallback.",
+          "description": "Source of the signal. phase_duration and app_install_duration never derive a duration from a span with mixed timestamp provenance (exactly one IME-log endpoint with sourceOffsetOrigin=reader-zone-fallback, i.e. the writer timezone was unknown to the agent for one endpoint only): such a condition evaluates false with evidence timestampProvenance=reader-zone-fallback. Two fallback endpoints share the same error and stay measurable.",
           "enum": ["event_type", "event_data", "event_data_array", "phase_duration", "event_count", "app_install_duration", "event_correlation", "clock_skew"]
         },
         "skewMetric": {
@@ -190,7 +190,7 @@
         },
         "operator": {
           "type": "string",
-          "description": "Comparison operator.",
+          "description": "Comparison operator. exists/not_exists with a dataField test whether ANY event of the type carries a non-empty value at that field: not_exists matches when no event does — including when the event type is absent altogether — so a rule can gate on a missing field (e.g. an ESP failure without an HRESULT). Without a dataField they test only the presence of the event type.",
           "enum": ["equals", "not_equals", "contains", "not_contains", "regex", "not_regex", "gt", "lt", "gte", "lte", "exists", "not_exists", "count_gte", "count_per_group_gte", "in", "not_in"]
         },
         "value": {

rules/schema/gather-rule.schema.json

@@ -114,6 +114,11 @@
           "description": "Emit behavior: \"always\" (default — emit on every collection) or \"on_change\" (poll on the trigger cadence but emit only when the collected result changes; the first in-scope result always emits).",
           "enum": ["always", "on_change"]
         },
+        "enrichErrorCodes": {
+          "type": "boolean",
+          "description": "Opt-in: let the backend explain error-code fields in this rule's output (exitCode, errorCode, hresult, ...) with the Windows/MSI/Intune error-code catalog, attaching the same *Info siblings built-in events get. Default false because gather-rule codes usually come from third-party logs or commands (HP Image Assistant, Dell Command Update, custom scripts) with their own exit-code numbering, where the catalog meaning would be wrong. Enable only when the parsed source really uses Windows codes (e.g. an msiexec or IME log).",
+          "default": false
+        },
         "outputEventType": {
           "type": "string",
           "description": "EventType for the emitted event (e.g., \"gather_proxy_settings\")."

rules/schema/guardrails.schema.json

@@ -8,6 +8,16 @@
     "$schema": { "type": "string" },
     "registryPrefixes": { "$ref": "#/$defs/categorizedList" },
     "filePrefixes": { "$ref": "#/$defs/stringList" },
+    "userProfileFilePrefixes": {
+      "description": "Folders under the signed-in user's profile that file collectors and diagnostics paths may read, RELATIVE to the profile root (e.g. \"AppData\\\\Local\\\\Vendor\"). Resolved against %LOGGED_ON_USER_PROFILE% at match time. Entries outside AppData\\Local / AppData\\Roaming are dropped at load: the C:\\Users hard block never admits them, so this list can only ever narrow what the block's exception already permits.",
+      "type": "array",
+      "items": {
+        "allOf": [
+          { "$ref": "#/$defs/safeString" },
+          { "pattern": "^AppData\\\\(Local|Roaming)(\\\\|$)" }
+        ]
+      }
+    },
     "wmiQueryPrefixes": { "$ref": "#/$defs/stringList" },
     "eventLogChannels": { "$ref": "#/$defs/categorizedList" },
     "blockedEventLogChannels": { "$ref": "#/$defs/stringList" },
@@ -16,6 +26,7 @@
     "blockedFilePrefixes": { "$ref": "#/$defs/stringList" },
     "blockedCommandPatterns": { "$ref": "#/$defs/stringList" },
     "blockedInterimTriggerEventTypes": { "$ref": "#/$defs/stringList" },
+    "imeLogDerivedEventTypes": { "$ref": "#/$defs/stringList" },
     "maxCommandLength": { "type": "integer", "minimum": 1, "maximum": 100000 }
   },
   "required": [

rules/schema/ime-log-pattern.schema.json

@@ -79,7 +79,8 @@
             "captureAppTypeWinGet",
             "captureAppTypeMsi",
             "captureAttemptNumber",
-            "captureDetectionResult"
+            "captureDetectionResult",
+            "captureExitCodeClass"
           ]
         },
         "parameters": {

rules/scripts/combine.js

@@ -142,6 +142,7 @@ if (fs.existsSync(guardrailsPath)) {
     assertStringList(guardrails[key], key);
   }
   assertStringList(guardrails.blockedInterimTriggerEventTypes ?? [], 'blockedInterimTriggerEventTypes');
+  assertStringList(guardrails.imeLogDerivedEventTypes ?? [], 'imeLogDerivedEventTypes');
   if (!Number.isInteger(guardrails.maxCommandLength) || guardrails.maxCommandLength < 1) {
     fail(`maxCommandLength: expected a positive integer, got ${JSON.stringify(guardrails.maxCommandLength)}`);
   }
@@ -207,6 +208,14 @@ export const ALLOWED_FILE_PREFIXES: readonly string[] = [
 ${flatArray(guardrails.filePrefixes)}
 ];
 
+// Folders under the signed-in user's profile, RELATIVE to the profile root. The agent
+// resolves %LOGGED_ON_USER_PROFILE% at runtime; the portal validates against a placeholder
+// profile. These cannot live in ALLOWED_FILE_PREFIXES — that list is matched literally
+// against the already-expanded path, where the user name is unknown at authoring time.
+export const USER_PROFILE_FILE_PREFIXES: readonly string[] = [
+${flatArray(guardrails.userProfileFilePrefixes ?? [])}
+];
+
 export const ALLOWED_WMI_QUERY_PREFIXES: readonly string[] = [
 ${flatArray(guardrails.wmiQueryPrefixes)}
 ];

scripts/Bootstrap/Install-AutopilotMonitor.Tests.ps1

@@ -14,6 +14,22 @@
 BeforeAll {
     . (Join-Path $PSScriptRoot 'Install-AutopilotMonitor.ps1')
 
+    function New-FakeSignature {
+        param([string]$Status, [string]$Subject)
+        $cert = if ($Subject) {
+            [pscustomobject]@{ Subject = $Subject; Thumbprint = '0123456789ABCDEF' }
+        } else { $null }
+        return [pscustomobject]@{ Status = $Status; SignerCertificate = $cert }
+    }
+
+    function New-FakePayload {
+        param([string[]]$Files)
+        $dir = Join-Path $TestDrive ([guid]::NewGuid().ToString())
+        New-Item -ItemType Directory -Path $dir -Force | Out-Null
+        foreach ($f in $Files) { Set-Content -Path (Join-Path $dir $f) -Value 'x' }
+        return $dir
+    }
+
     function New-FakeProfile {
         param([string]$Name, [double]$AgeMinutes)
         $p = Join-Path $TestDrive $Name
@@ -305,3 +321,93 @@ Describe 'logging purity' {
         Get-Content $LogFile -Raw | Should -Match 'SKIP: Agent was previously deployed'
     }
 }
+
+Describe 'Get-UnverifiedAgentBinaries' {
+    # The publisher gate on the extracted payload. What matters is the DECISION: which
+    # payload is accepted, which is refused, and which files are looked at at all.
+    BeforeEach {
+        Mock Write-Log { }
+        $script:ours = 'CN=glueckkanja AG, O=glueckkanja AG, C=DE'
+    }
+
+    It 'accepts a payload where every binary of ours is validly signed by us' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe', 'AutopilotMonitor.Shared.dll')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject $script:ours }
+        Get-UnverifiedAgentBinaries -Path $dir | Should -BeNullOrEmpty
+    }
+
+    It 'checks the binaries we author and leaves third-party assemblies alone' {
+        $dir = New-FakePayload -Files @(
+            'AutopilotMonitor.Agent.exe',
+            'AutopilotMonitor.Agent.exe.config',
+            'AutopilotMonitor.Shared.dll',
+            'Newtonsoft.Json.dll',
+            'System.Management.Automation.dll'
+        )
+        $script:checked = @()
+        Mock Get-AuthenticodeSignature {
+            $script:checked += (Split-Path $FilePath -Leaf)
+            New-FakeSignature -Status 'Valid' -Subject $script:ours
+        }
+
+        Get-UnverifiedAgentBinaries -Path $dir | Should -BeNullOrEmpty
+        $script:checked | Should -Be @('AutopilotMonitor.Agent.exe', 'AutopilotMonitor.Shared.dll')
+    }
+
+    It 'refuses an unsigned agent executable' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'NotSigned' -Subject $null }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses a tampered binary (hash mismatch)' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'HashMismatch' -Subject $script:ours }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses a signature whose chain does not validate' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'UnknownError' -Subject $script:ours }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses a validly signed binary from a different publisher' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject 'CN=Somebody Else, O=Somebody Else Ltd, C=US' }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses the whole payload when a single DLL of ours is swapped' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe', 'AutopilotMonitor.Shared.dll')
+        Mock Get-AuthenticodeSignature {
+            if ((Split-Path $FilePath -Leaf) -eq 'AutopilotMonitor.Shared.dll') {
+                New-FakeSignature -Status 'Valid' -Subject 'CN=Somebody Else, O=Somebody Else Ltd, C=US'
+            } else {
+                New-FakeSignature -Status 'Valid' -Subject $script:ours
+            }
+        }
+        $rejected = Get-UnverifiedAgentBinaries -Path $dir
+        $rejected.Count | Should -Be 1
+        $rejected[0] | Should -BeLike 'AutopilotMonitor.Shared.dll*'
+    }
+
+    It 'refuses when the signature check itself throws' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { throw 'access denied' }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses an empty payload instead of passing it' {
+        $dir = New-FakePayload -Files @('Newtonsoft.Json.dll')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject $script:ours }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+}
+
+Describe 'publisher pin' {
+    It 'pins the expected publisher by subject, not by thumbprint' {
+        $ExpectedPublisher | Should -Be '*O=glueckkanja AG*'
+        $ExpectedPublisher | Should -Not -Match '^[0-9A-Fa-f]{40}$'
+    }
+}

scripts/Bootstrap/Install-AutopilotMonitor.ps1

@@ -12,8 +12,9 @@
       2. Downloads the monitoring agent ZIP from Azure Blob Storage
       3. Verifies integrity via SHA-256 hash from the version manifest (mandatory)
       4. Extracts the agent into %ProgramData%\AutopilotMonitor\Agent
-      5. Runs the agent in --install mode (registers Scheduled Task, spawns the runtime)
-      6. Verifies the runtime process actually launched
+      5. Verifies the Authenticode signature and publisher of every binary we author
+      6. Runs the agent in --install mode (registers Scheduled Task, spawns the runtime)
+      7. Verifies the runtime process actually launched
     Agent self-destructs when enrollment completes.
 
     Relax flow (guards 2+3): a real user profile (or a real LastLoggedOnUser)
@@ -76,6 +77,11 @@
       PowerShell 5.1 (IME) reads scripts without BOM as ANSI, corrupting multi-byte chars.
 
 .CHANGELOG
+    2026-09-08  v2.5  Publisher gate: every AutopilotMonitor binary in the extracted
+                      payload must carry a valid Authenticode signature from the
+                      expected publisher before --install runs. The SHA-256 manifest
+                      check stays and is unchanged; it proves the bytes, the signature
+                      proves the author.
     2026-08-08  v2.3  Windows 365 Cloud PC support: a positively identified Cloud PC
                       (Windows365 registry key AND CloudManagedDesktopExtension
                       service) now triggers the guard 2+3 relax alongside OOBE
@@ -128,7 +134,12 @@ param(
 )
 
 # Script version (bump on meaningful changes; see .CHANGELOG above)
-$ScriptVersion = "2.4"
+$ScriptVersion = "2.5"
+
+# The publisher every binary we author must carry. A -like pattern on the subject, NOT a
+# thumbprint: certificates are renewed, deployed copies of this script are not. Same value
+# the loader pins for this script.
+$ExpectedPublisher = "*O=glueckkanja AG*"
 
 # Configuration - Everything in ProgramData for easy cleanup
 $AgentBasePath = "$env:ProgramData\AutopilotMonitor"
@@ -329,6 +340,56 @@ function Get-BootstrapDecision {
     return [pscustomobject]@{ Install = $true; ReasonCode = $null; RelaxActive = $relax.Active }
 }
 
+# Returns the list of reasons why the extracted payload is not ours; an empty result means
+# every binary we author carries a valid Authenticode signature from the expected publisher.
+# Third-party assemblies keep their own publisher's signature and are not checked here.
+# Any error is a rejection: an unreadable signature is an unverified binary.
+function Get-UnverifiedAgentBinaries {
+    param([string]$Path)
+
+    $rejected = @()
+    $ourBinaries = @(
+        Get-ChildItem -Path $Path -Filter 'AutopilotMonitor.*' -File -ErrorAction SilentlyContinue |
+            Where-Object { $_.Extension -in @('.exe', '.dll') }
+    )
+
+    # An empty set is a rejection, not a pass: it means the extraction produced nothing we
+    # recognise, and the alternative would be a gate that silently approves an empty folder.
+    # The comma keeps a single rejection an ARRAY: PowerShell unrolls a one-element result to
+    # a bare string, and the caller reads .Count and indexes into it.
+    if ($ourBinaries.Count -eq 0) {
+        return , @("no AutopilotMonitor binaries found in $Path")
+    }
+
+    foreach ($binary in $ourBinaries) {
+        try {
+            $sig = Get-AuthenticodeSignature -FilePath $binary.FullName -ErrorAction Stop
+        }
+        catch {
+            $rejected += "$($binary.Name): signature check failed to run ($($_.Exception.Message))"
+            continue
+        }
+
+        if ($null -eq $sig) {
+            $rejected += "$($binary.Name): signature check returned nothing"
+            continue
+        }
+
+        $subject = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { '<unsigned>' }
+
+        if ($sig.Status -ne 'Valid') {
+            $rejected += "$($binary.Name): signature status $($sig.Status)"
+            continue
+        }
+        if ($subject -notlike $ExpectedPublisher) {
+            $rejected += "$($binary.Name): unexpected publisher $subject"
+            continue
+        }
+    }
+
+    return , $rejected
+}
+
 # Main bootstrap flow. Only invoked when the script is run directly (see entry guard
 # at the bottom); never on dot-source.
 function Invoke-Bootstrap {
@@ -445,6 +506,20 @@ function Invoke-Bootstrap {
             }
         }
 
+        # Publisher gate. The SHA-256 above proves the ZIP is the one the manifest names, but
+        # that manifest lives in the same container as the ZIP and cannot outlive a compromise
+        # of the download host. The expected publisher travels inside THIS script, which the
+        # loader verified before running it, so the chain from the file an administrator
+        # assigns to the process that starts here stays publisher-anchored end to end.
+        # Fail-closed, exactly like the hash check: running unverified code as SYSTEM is the
+        # risk being removed.
+        Write-Log "Verifying Authenticode signatures of the agent binaries..."
+        $unverified = Get-UnverifiedAgentBinaries -Path $AgentBinPath
+        if ($unverified.Count -gt 0) {
+            throw "Authenticode verification FAILED ($($unverified -join '; ')). Refusing to run an agent that is not signed by the expected publisher."
+        }
+        Write-Log "Authenticode verification passed (publisher pin: $ExpectedPublisher)"
+
         Write-Log "Calling agent install mode (--install)..."
         & $agentExePath --install
         $installExitCode = $LASTEXITCODE

scripts/Bootstrap/Start-AutopilotMonitor.Tests.ps1

@@ -0,0 +1,147 @@
+# Pester tests (Pester 5+) for the stage-1 loader Start-AutopilotMonitor.ps1.
+#
+# The script under test is dot-sourced; its entry guard prevents the loader from
+# executing, so loading it here is side-effect free. Network and signature checks
+# are mocked -- what is verified is the DECISION: what does the loader accept, what
+# does it refuse, and how often does it retry.
+#
+# Run under Windows PowerShell 5.1 to match the IME runtime:
+#   powershell.exe -NoProfile -Command "& { $c = New-PesterConfiguration; $c.Run.Path = 'scripts\Bootstrap'; $c.Output.Verbosity = 'Detailed'; Invoke-Pester -Configuration $c }"
+#
+# This file MUST remain pure ASCII (PS 5.1 reads BOM-less files as ANSI).
+
+BeforeAll {
+    . (Join-Path $PSScriptRoot 'Start-AutopilotMonitor.ps1')
+
+    function New-FakeSignature {
+        param([string]$Status, [string]$Subject)
+        $cert = if ($Subject) {
+            [pscustomobject]@{ Subject = $Subject; Thumbprint = '0123456789ABCDEF' }
+        } else { $null }
+        return [pscustomobject]@{ Status = $Status; SignerCertificate = $cert }
+    }
+}
+
+Describe 'Test-BootstrapSignature' {
+    BeforeEach {
+        Mock Write-Log { }
+    }
+
+    It 'accepts a valid signature from the expected publisher' {
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject 'CN=glueckkanja AG, O=glueckkanja AG, C=DE' }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeTrue
+    }
+
+    # An EV subject is a line of street address and registration numbers; the log gets the CN.
+    It 'logs the signer CN, not the whole subject' {
+        Mock Get-AuthenticodeSignature {
+            New-FakeSignature -Status 'Valid' -Subject 'CN=glueckkanja AG, O=glueckkanja AG, L=Offenbach am Main, C=DE, SERIALNUMBER=HRB 12381'
+        }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeTrue
+        Should -Invoke Write-Log -ParameterFilter { $Message -eq 'Signature status: Valid. Signer: glueckkanja AG' }
+    }
+
+    It 'refuses an unsigned script' {
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'NotSigned' -Subject $null }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeFalse
+    }
+
+    It 'refuses a tampered script (hash mismatch)' {
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'HashMismatch' -Subject 'CN=glueckkanja AG, O=glueckkanja AG, C=DE' }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeFalse
+    }
+
+    It 'refuses a signature whose chain does not validate' {
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'UnknownError' -Subject 'CN=glueckkanja AG, O=glueckkanja AG, C=DE' }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeFalse
+    }
+
+    # The whole point of the pinned publisher: a validly signed script from someone else
+    # is exactly what an attacker with any code-signing certificate can produce.
+    It 'refuses a valid signature from a different publisher' {
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject 'CN=Somebody Else, O=Somebody Else Ltd, C=US' }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeFalse
+    }
+
+    It 'refuses when the signature check itself fails' {
+        Mock Get-AuthenticodeSignature { throw 'file not found' }
+        Test-BootstrapSignature -Path 'TestDrive:\x.ps1' | Should -BeFalse
+    }
+}
+
+Describe 'Get-VerifiedBootstrapScript' {
+    BeforeEach {
+        Mock Write-Log { }
+        Mock Start-Sleep { }
+        Mock Invoke-WebRequest { }
+    }
+
+    It 'returns after the first attempt when the download verifies' {
+        Mock Test-BootstrapSignature { $true }
+        Get-VerifiedBootstrapScript -Url 'https://example.invalid/s.ps1' -Destination 'TestDrive:\s.ps1' | Should -BeTrue
+        Should -Invoke Invoke-WebRequest -Times 1 -Exactly
+    }
+
+    It 'gives up after three attempts when verification keeps failing' {
+        Mock Test-BootstrapSignature { $false }
+        Get-VerifiedBootstrapScript -Url 'https://example.invalid/s.ps1' -Destination 'TestDrive:\s.ps1' | Should -BeFalse
+        Should -Invoke Invoke-WebRequest -Times 3 -Exactly
+    }
+
+    # A truncated or proxy-mangled body fails verification, so the retry has to cover the
+    # download AND the check, not just the transport.
+    It 'retries a failed verification and accepts a later attempt' {
+        $script:calls = 0
+        Mock Test-BootstrapSignature { $script:calls++; return ($script:calls -ge 2) }
+        Get-VerifiedBootstrapScript -Url 'https://example.invalid/s.ps1' -Destination 'TestDrive:\s.ps1' | Should -BeTrue
+        Should -Invoke Invoke-WebRequest -Times 2 -Exactly
+    }
+
+    It 'retries a transport failure' {
+        $script:downloads = 0
+        Mock Invoke-WebRequest { $script:downloads++; if ($script:downloads -eq 1) { throw 'connection reset' } }
+        Mock Test-BootstrapSignature { $true }
+        Get-VerifiedBootstrapScript -Url 'https://example.invalid/s.ps1' -Destination 'TestDrive:\s.ps1' | Should -BeTrue
+        Should -Invoke Invoke-WebRequest -Times 2 -Exactly
+    }
+
+    It 'never executes anything when no attempt verifies' {
+        Mock Test-BootstrapSignature { $false }
+        Get-VerifiedBootstrapScript -Url 'https://example.invalid/s.ps1' -Destination 'TestDrive:\s.ps1' | Should -BeFalse
+    }
+}
+
+Describe 'publish contract' {
+    BeforeAll {
+        $script:loaderText = Get-Content (Join-Path $PSScriptRoot 'Start-AutopilotMonitor.ps1') -Raw
+    }
+
+    # Publish-BootstrapScripts.ps1 renders the -Dev loader by substituting this exact
+    # literal and fails the publish when it is gone. Catching that here means the PR fails
+    # instead of the publish.
+    It 'carries the dev-render anchor the publisher substitutes' {
+        $anchor = '$BootstrapUrl = "https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor.ps1"'
+        $script:loaderText.Contains($anchor) | Should -BeTrue
+    }
+
+    # The publisher parses this to write version.json.loaderVersion and to run the
+    # version-bump guard.
+    It 'declares a parsable ScriptVersion' {
+        $script:loaderText -match '\$ScriptVersion\s*=\s*"([\d\.\-a-zA-Z]+)"' | Should -BeTrue
+    }
+
+    It 'pins the expected publisher by subject, not by thumbprint' {
+        $script:loaderText -match '\$ExpectedPublisher\s*=\s*"\*O=' | Should -BeTrue
+    }
+
+    # The bootstrap MSI installs this same file and runs it with -LogFileName so the delivery
+    # channel stays visible in a diagnostics package. Renaming the parameter on either side
+    # would leave the MSI channel silently logging under the wrong name.
+    It 'keeps the -LogFileName contract the bootstrap MSI relies on' {
+        $script:loaderText -match '\[string\]\$LogFileName' | Should -BeTrue
+
+        $wxs = Get-Content (Join-Path $PSScriptRoot '..\..\src\Agent\AutopilotMonitor.BootstrapMsi\Package.wxs') -Raw
+        $wxs.Contains('[INSTALLFOLDER]Start-AutopilotMonitor.ps1') | Should -BeTrue
+        $wxs.Contains('-LogFileName bootstrap-msi.log') | Should -BeTrue
+    }
+}

scripts/Bootstrap/Start-AutopilotMonitor.ps1

@@ -0,0 +1,216 @@
+<#
+.SYNOPSIS
+    Stage 1 of the Autopilot Monitor bootstrap: fetches the current installer and runs it.
+
+.DESCRIPTION
+    This is the file an administrator assigns in Intune, and the same file the bootstrap MSI
+    installs and runs -- one implementation for both delivery channels; the MSI is only the
+    packaging. It carries no enrollment logic at all: it downloads the published
+    Install-AutopilotMonitor.ps1, proves that it was signed by Autopilot Monitor, and runs it
+    in this process.
+
+    Why two stages: the installer holds every guard, relax rule and download path, and those
+    change. Whoever assigns the installer directly has to replace their Intune copy each
+    time; whoever assigns this loader never does, because the part that changes lives on the
+    server. Assigning the installer directly stays supported and unchanged.
+
+    This file is deliberately boring. It is the one piece that cannot be fixed remotely, so
+    it does the least it can: download, verify, invoke, log.
+
+    Verification is by Authenticode publisher, not by hash. A hash oracle would have to be
+    fetched from the same host as the script itself, so it could not survive a compromise of
+    that host, while the expected publisher below travels with this file. It pins the
+    certificate SUBJECT and not a thumbprint, so a certificate renewal does not brick a
+    loader that is already deployed on devices.
+
+    Fail-soft: the loader always exits 0 and never throws into the caller. A device that
+    cannot reach the download endpoint is a device without monitoring, never a failed
+    enrollment step. Verification failures are the same: nothing runs, and the reason is in
+    the log. Refusing to execute unverified code as SYSTEM is the point of this file.
+
+    This file MUST remain pure ASCII (PS 5.1 reads BOM-less files as ANSI).
+
+.PARAMETER BootstrapUrl
+    Installer URL. Defaults to the published stable installer; the -Dev variant of this
+    loader is rendered from that default at publish time.
+
+.PARAMETER LogFileName
+    Log file inside the agent log directory. The MSI channel passes bootstrap-msi.log so the
+    delivery channel stays visible in a diagnostics package; the diag tooling keys on these
+    names, so do not rename them.
+
+.PARAMETER BootstrapArguments
+    Everything else is passed through to the installer unchanged, so any parameter the
+    installer accepts can be set here without this file knowing about it.
+
+.EXAMPLE
+    .\Start-AutopilotMonitor.ps1
+
+.EXAMPLE
+    .\Start-AutopilotMonitor.ps1 -MaxBootstrapWindowHours 24
+
+.NOTES
+    Author  : Oliver Kieselbach (autopilotmonitor.com)
+    Runtime : Windows PowerShell 5.1, SYSTEM context, during Autopilot enrollment
+
+.CHANGELOG
+    2026-09-08  v1.2  Log the signer CN instead of the full EV subject; the full subject is
+                      logged only when the publisher is why a script was rejected.
+    2026-09-08  v1.1  Also used by the bootstrap MSI, which replaced its own copy of this
+                      logic; -LogFileName keeps the channel visible in diagnostics.
+    2026-09-08  v1.0  Initial version: two-stage bootstrap, publisher-pinned verification.
+#>
+
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $false)]
+    [string]$BootstrapUrl = "https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor.ps1",
+
+    [Parameter(Mandatory = $false)]
+    [ValidatePattern('^[A-Za-z0-9._-]+$')]
+    [string]$LogFileName = "bootstrap-loader.log",
+
+    [Parameter(Mandatory = $false, ValueFromRemainingArguments = $true)]
+    [string[]]$BootstrapArguments
+)
+
+# Script version (bump on meaningful changes; see .CHANGELOG above)
+$ScriptVersion = "1.2"
+
+# The publisher every downloaded stage-2 script must carry. A -like pattern on the subject,
+# NOT a thumbprint: certificates are renewed, deployed loaders are not.
+$ExpectedPublisher = "*O=glueckkanja AG*"
+
+$LoaderBasePath = "$env:ProgramData\AutopilotMonitor"
+$LoaderLogPath  = "$LoaderBasePath\Logs"
+$LogFile        = "$LoaderLogPath\$LogFileName"
+$BootstrapPath  = "$LoaderBasePath\Install-AutopilotMonitor.ps1"
+
+$DownloadAttempts = 3
+$RetryDelaySeconds = 10
+
+# Write-Host as well as the file: the Intune script output is what an administrator sees in
+# the portal, the file is what a support case reads.
+function Write-Log {
+    param([string]$Message)
+    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
+    $logMessage = "[$timestamp] $Message"
+    Write-Host $logMessage
+    Add-Content -Path $LogFile -Value $logMessage -ErrorAction SilentlyContinue
+}
+
+# True only when the file is signed, the signature validates against the machine's trust
+# chain, and the signer is us. Any error is a false -- an unreadable signature is an
+# unverified script.
+function Test-BootstrapSignature {
+    param([string]$Path)
+
+    try {
+        $sig = Get-AuthenticodeSignature -FilePath $Path -ErrorAction Stop
+    }
+    catch {
+        Write-Log "Signature check failed to run: $($_.Exception.Message)"
+        return $false
+    }
+
+    if ($null -eq $sig) {
+        Write-Log "Signature check returned nothing."
+        return $false
+    }
+
+    # The full subject of an EV certificate is a line of street address and registration
+    # numbers. The CN answers the only question the log has to answer; the full subject is
+    # logged when it is the reason for a rejection.
+    $subject = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { "<unsigned>" }
+    $signer = if ($subject -match 'CN=([^,]+)') { $Matches[1] } else { $subject }
+    Write-Log "Signature status: $($sig.Status). Signer: $signer"
+
+    if ($sig.Status -ne 'Valid') {
+        Write-Log "REJECTED: expected signature status 'Valid'."
+        return $false
+    }
+    if ($subject -notlike $ExpectedPublisher) {
+        Write-Log "REJECTED: signer does not match the expected publisher. Full subject: $subject"
+        return $false
+    }
+
+    Write-Log "Signature accepted (thumbprint $($sig.SignerCertificate.Thumbprint))."
+    return $true
+}
+
+# Downloads the installer and returns $true once a downloaded copy passes verification.
+# Verification lives inside the retry loop on purpose: a truncated or proxy-mangled body
+# fails the signature check, and that is worth another attempt.
+function Get-VerifiedBootstrapScript {
+    param([string]$Url, [string]$Destination)
+
+    for ($attempt = 1; $attempt -le $DownloadAttempts; $attempt++) {
+        try {
+            Write-Log "Download attempt $attempt/$DownloadAttempts from $Url"
+            Invoke-WebRequest -Uri $Url -OutFile $Destination -UseBasicParsing -TimeoutSec 60 -ErrorAction Stop
+
+            if (Test-BootstrapSignature -Path $Destination) {
+                return $true
+            }
+        }
+        catch {
+            Write-Log "Download attempt $attempt failed: $($_.Exception.Message)"
+        }
+
+        if ($attempt -lt $DownloadAttempts) {
+            Start-Sleep -Seconds $RetryDelaySeconds
+        }
+    }
+
+    return $false
+}
+
+# Main flow. Only invoked when the script is run directly (see entry guard at the bottom),
+# so the Pester suite can dot-source this file without bootstrapping anything.
+function Start-BootstrapLoader {
+    New-Item -ItemType Directory -Force -Path $LoaderLogPath -ErrorAction SilentlyContinue | Out-Null
+
+    Write-Log "=== Autopilot Monitor bootstrap loader v$ScriptVersion started (user=$env:USERNAME, pid=$PID) ==="
+
+    # PS 5.1 on an OOBE device still defaults to TLS 1.0 for this process.
+    try {
+        [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
+    }
+    catch {
+        Write-Log "INFO: could not raise the TLS protocol: $($_.Exception.Message)"
+    }
+
+    if (-not (Get-VerifiedBootstrapScript -Url $BootstrapUrl -Destination $BootstrapPath)) {
+        Write-Log "No verified installer available after $DownloadAttempts attempt(s). Nothing was executed."
+        return
+    }
+
+    Write-Log "Executing $BootstrapPath"
+
+    # Same process, so the execution policy this loader runs under applies to stage 2 as
+    # well and no second policy decision can strand the installer. Splatting an array of
+    # remaining arguments keeps this file free of any knowledge about the installer's
+    # parameters.
+    $arguments = @()
+    if ($BootstrapArguments) { $arguments = $BootstrapArguments }
+
+    try {
+        & $BootstrapPath @arguments
+        Write-Log "Installer finished (exit code $LASTEXITCODE)."
+    }
+    catch {
+        Write-Log "Installer threw: $($_.Exception.Message)"
+    }
+}
+
+# Entry guard: dot-sourcing (Pester) loads the functions without running the loader.
+if ($MyInvocation.InvocationName -ne '.') {
+    try {
+        Start-BootstrapLoader
+    }
+    catch {
+        # Nothing above should throw; if it does, it must not become a failed Intune script.
+        Write-Log "Loader failed: $($_.Exception.Message)"
+    }
+    exit 0
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/EventTypeConstantGuardTests.cs

@@ -152,18 +152,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests
                 .Where(p => !p.Contains($"{Path.DirectorySeparatorChar}obj{Path.DirectorySeparatorChar}")
                             && !p.Contains($"{Path.DirectorySeparatorChar}bin{Path.DirectorySeparatorChar}"));
 
-        private static string RepoRoot()
-        {
-            var dir = AppContext.BaseDirectory;
-            for (int i = 0; i < 12; i++)
-            {
-                if (File.Exists(Path.Combine(dir, "AutopilotMonitor.sln"))) return dir;
-                var parent = Directory.GetParent(dir)?.FullName;
-                if (parent == null || parent == dir) break;
-                dir = parent;
-            }
-            throw new DirectoryNotFoundException(
-                "Could not locate repo root (AutopilotMonitor.sln) from " + AppContext.BaseDirectory);
-        }
+        private static string RepoRoot() => Harness.RepoPaths.Root();
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Harness/RepoPaths.cs

@@ -0,0 +1,27 @@
+using System;
+using System.IO;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Harness
+{
+    /// <summary>Repository paths for tests that read or write checked-in files (guards, fixtures).</summary>
+    internal static class RepoPaths
+    {
+        /// <summary>Walks up from the test binary to the directory holding <c>AutopilotMonitor.sln</c>.</summary>
+        public static string Root()
+        {
+            var dir = AppContext.BaseDirectory;
+            for (int i = 0; i < 12; i++)
+            {
+                if (File.Exists(Path.Combine(dir, "AutopilotMonitor.sln"))) return dir;
+                var parent = Directory.GetParent(dir)?.FullName;
+                if (parent == null || parent == dir) break;
+                dir = parent;
+            }
+            throw new DirectoryNotFoundException(
+                "Could not locate repo root (AutopilotMonitor.sln) from " + AppContext.BaseDirectory);
+        }
+
+        /// <summary><c>tests/fixtures/&lt;name&gt;</c> under the repo root.</summary>
+        public static string Fixtures(string name) => Path.Combine(Root(), "tests", "fixtures", name);
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Integration/EnrollmentOrchestratorFixture.cs

@@ -13,6 +13,7 @@ using AutopilotMonitor.DecisionCore.Classifiers;
 using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
 using AutopilotMonitor.DecisionCore.State;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Integration
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Integration/ScenarioTests.cs

@@ -5,6 +5,7 @@ using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using AutopilotMonitor.DecisionCore.Classifiers;
 using AutopilotMonitor.DecisionCore.State;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 #pragma warning disable xUnit1031 // SpinWait.SpinUntil for uploader-batch-arrival assertion
 

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/EspAndHelloTrackerShellCoreFailureInheritanceTests.cs

@@ -0,0 +1,132 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.SignalAdapters;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Signals;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
+{
+    /// <summary>
+    /// Session 683f1eff — a Shell-Core 62407 failure (<c>WhiteGlove_Failed</c>) arrived four
+    /// seconds into the provisioning tracker's 30-s settle window and terminalised the session
+    /// with nothing but its failure type: the HRESULT (0x80070652) and the failed subcategory
+    /// (Apps) the registry had already named never reached the terminal event, the backend
+    /// FailureReason or the termination-time app classification. The coordinator now inherits
+    /// the pending settle detail onto the Shell-Core args and records the terminal-failure
+    /// snapshot from it.
+    /// </summary>
+    public sealed class EspAndHelloTrackerShellCoreFailureInheritanceTests
+    {
+        private static readonly DateTime Fixed = new DateTime(2026, 9, 8, 18, 11, 6, DateTimeKind.Utc);
+
+        private sealed class Fixture : IDisposable
+        {
+            public TempDirectory Tmp { get; } = new TempDirectory();
+            public AgentLogger Logger { get; }
+            public FakeSignalIngressSink Ingress { get; } = new FakeSignalIngressSink();
+            public FakeSignalIngressSink TrackerPostSink { get; } = new FakeSignalIngressSink();
+            public VirtualClock Clock { get; } = new VirtualClock(Fixed);
+            public List<EspFailureDetectedEventArgs> Forwarded { get; } = new List<EspFailureDetectedEventArgs>();
+
+            public Fixture() { Logger = new AgentLogger(Tmp.Path, AgentLogLevel.Debug); }
+
+            public EspAndHelloTracker BuildCoordinator(Func<EspFailureDetectedEventArgs?> pendingProbe)
+            {
+                var coordinator = new EspAndHelloTracker(
+                    sessionId: "S1",
+                    tenantId: "T1",
+                    post: new InformationalEventPost(TrackerPostSink, Clock),
+                    logger: Logger,
+                    skipConfigProbe: () => ((bool?)false, (bool?)false),
+                    accountSetupActivityProbe: () => false,
+                    pendingEspFailureProbe: pendingProbe);
+                coordinator.EspFailureDetected += (_, args) => Forwarded.Add(args);
+                return coordinator;
+            }
+
+            public FakeSignalIngressSink.PostedSignal TerminalSignal() =>
+                Assert.Single(Ingress.Posted, p => p.Kind == DecisionSignalKind.EspTerminalFailure);
+
+            public void Dispose() { Tmp.Dispose(); }
+        }
+
+        private static EspFailureDetectedEventArgs PendingAppsFailure() => new EspFailureDetectedEventArgs(
+            failureType: "Provisioning_DeviceSetup_Apps_Failed",
+            errorCode: "0x80070652",
+            failedSubcategory: "Apps",
+            category: "DeviceSetup",
+            likelyCulpritApps: new[] { "ESP Finalizer US" });
+
+        [Fact]
+        public void ShellCore_failure_inside_the_settle_window_inherits_the_registry_detail()
+        {
+            using var f = new Fixture();
+            using var coordinator = f.BuildCoordinator(PendingAppsFailure);
+            using var adapter = new EspAndHelloTrackerAdapter(coordinator, f.Ingress, f.Clock);
+
+            coordinator.TriggerShellCoreEspFailureForTest("WhiteGlove_Failed");
+
+            var args = Assert.Single(f.Forwarded);
+            Assert.Equal("WhiteGlove_Failed", args.FailureType);   // the signal that terminalised
+            Assert.Equal("0x80070652", args.ErrorCode);
+            Assert.Equal("Apps", args.FailedSubcategory);
+            Assert.Equal("DeviceSetup", args.Category);
+            Assert.Equal(new[] { "ESP Finalizer US" }, args.LikelyCulpritApps);
+
+            // Wire-through: the EspTerminalFailure signal payload carries the detail the
+            // DecisionEngine copies onto enrollment_failed.
+            var signal = f.TerminalSignal();
+            Assert.Equal("WhiteGlove_Failed", signal.Payload!["failureType"]);
+            Assert.Equal("0x80070652", signal.Payload["errorCode"]);
+            Assert.Equal("Apps", signal.Payload["failedSubcategory"]);
+            Assert.Equal("DeviceSetup", signal.Payload["category"]);
+            Assert.Equal("ESP Finalizer US", signal.Payload["likelyCulpritApps"]);
+
+            // Termination-time classification reads the same context.
+            Assert.NotNull(coordinator.LastEspTerminalFailure);
+            Assert.Equal("0x80070652", coordinator.LastEspTerminalFailure.ErrorCode);
+            Assert.True(coordinator.LastEspTerminalFailure.IsAppsSubcategory);
+        }
+
+        [Fact]
+        public void ShellCore_failure_without_a_pending_window_stays_bare()
+        {
+            using var f = new Fixture();
+            using var coordinator = f.BuildCoordinator(() => null);
+            using var adapter = new EspAndHelloTrackerAdapter(coordinator, f.Ingress, f.Clock);
+
+            coordinator.TriggerShellCoreEspFailureForTest("ESPProgress_Timeout");
+
+            var args = Assert.Single(f.Forwarded);
+            Assert.Equal("ESPProgress_Timeout", args.FailureType);
+            Assert.Null(args.ErrorCode);
+            Assert.Null(args.FailedSubcategory);
+            Assert.Null(args.Category);
+            Assert.Empty(args.LikelyCulpritApps);
+            Assert.Null(coordinator.LastEspTerminalFailure);
+
+            var signal = f.TerminalSignal();
+            Assert.False(signal.Payload!.ContainsKey("errorCode"));
+            Assert.False(signal.Payload.ContainsKey("failedSubcategory"));
+        }
+
+        [Fact]
+        public void A_throwing_probe_degrades_to_the_bare_failure()
+        {
+            using var f = new Fixture();
+            using var coordinator = f.BuildCoordinator(() => throw new InvalidOperationException("probe"));
+
+            coordinator.TriggerShellCoreEspFailureForTest("WhiteGlove_Failed");
+
+            var args = Assert.Single(f.Forwarded);
+            Assert.Equal("WhiteGlove_Failed", args.FailureType);
+            Assert.Null(args.ErrorCode);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/GatherRuleCollectorGuardTests.cs

@@ -456,5 +456,124 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
 
             SingleSecurityWarning();
         }
+
+        // -------------------------------------------------------------------
+        // %LOGGED_ON_USER_PROFILE% exception (userProfilePath overload)
+        //
+        // The token lifts the C:\Users hard block for AppData\Local and
+        // AppData\Roaming — and nothing more. The allowlist still decides,
+        // which is what the cases below pin down: the exception is a gate the
+        // allowlist has to open, never an allowance of its own.
+        // -------------------------------------------------------------------
+
+        private const string TestProfile = @"C:\Users\TestUser";
+
+        [Fact]
+        public void UserProfile_AppDataPath_WithoutAllowlistEntry_IsStillBlocked()
+        {
+            // The lifted hard block alone admits nothing: without a matching
+            // userProfileFilePrefixes entry the path falls through to the
+            // allowlist and is refused there.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_OutsideAppData_IsBlockedByTheHardBlock()
+        {
+            foreach (var target in new[] { @"\Desktop\secret.txt", @"\Documents\notes.txt", @"\ntuser.dat" })
+            {
+                Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                    TestProfile + target, unrestrictedMode: false, userProfilePath: TestProfile));
+            }
+        }
+
+        [Fact]
+        public void UserProfile_NullProfile_KeepsTheUsersHardBlock()
+        {
+            // No interactive user detected — the exception cannot apply and the
+            // path stays under the plain C:\Users block.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\TestUser\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: false, userProfilePath: null));
+        }
+
+        [Fact]
+        public void UserProfile_TraversalOutOfAppData_IsBlocked()
+        {
+            // Spelling Documents as a traversal out of AppData must not survive
+            // Path.GetFullPath normalisation.
+            const string traversal = @"C:\Users\TestUser\AppData\Local\..\..\Documents\secret.txt";
+
+            Assert.Equal(@"C:\Users\TestUser\Documents\secret.txt", Path.GetFullPath(traversal));
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                traversal, unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_ForeignProfile_IsBlockedEvenUnderAppData()
+        {
+            // The exception is scoped to the DETECTED profile — a rule must not
+            // reach a second user's AppData by spelling the path out.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\OtherUser\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_AllowlistedVendorFolder_IsAllowed()
+        {
+            // AppData\Local\RealmJoin is on userProfileFilePrefixes: the file itself, a
+            // subfolder below it, and the folder itself all pass.
+            foreach (var target in new[] { @"\tray.log", @"\Logs\rj.log", "" })
+            {
+                Assert.True(GatherRuleGuards.IsFilePathAllowed(
+                    TestProfile + @"\AppData\Local\RealmJoin" + target,
+                    unrestrictedMode: false, userProfilePath: TestProfile),
+                    $"expected allowed: ...\\RealmJoin{target}");
+            }
+        }
+
+        [Fact]
+        public void UserProfile_SiblingOfAnAllowlistedVendorFolder_IsBlocked()
+        {
+            // Segment-bounded: "RealmJoin" must not admit "RealmJoinSomethingElse".
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\AppData\Local\RealmJoinSomethingElse\tray.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_AllowlistedVendorFolder_InAForeignProfile_IsBlocked()
+        {
+            // The allowlist is anchored to the DETECTED profile, not to C:\Users\*.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\OtherUser\AppData\Local\RealmJoin\tray.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_AllowlistedVendorFolder_WithoutADetectedUser_IsBlocked()
+        {
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\TestUser\AppData\Local\RealmJoin\tray.log",
+                unrestrictedMode: false, userProfilePath: null));
+        }
+
+        [Fact]
+        public void UserProfile_AppDataPath_IsAllowedInUnrestrictedMode()
+        {
+            // Where the exception does bite today: unrestricted mode returns
+            // before the allowlist, so the lifted hard block is the whole story.
+            Assert.True(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: true, userProfilePath: TestProfile));
+
+            // ...but only under AppData — Documents stays blocked even there.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\Documents\secret.txt",
+                unrestrictedMode: true, userProfilePath: TestProfile));
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/GatherRuleExecutorEnrichErrorCodesTests.cs

@@ -0,0 +1,111 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Threading;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather
+{
+    /// <summary>
+    /// <see cref="GatherRule.EnrichErrorCodes"/> is an opt-in the backend honours at response time:
+    /// the agent stamps <c>enrichErrorCodes: true</c> into the event data of a rule that set it and
+    /// nothing at all otherwise (the default payload stays as it was).
+    /// </summary>
+    [Collection("SerialThreading")] // startup rules execute on the shared ThreadPool
+    public sealed class GatherRuleExecutorEnrichErrorCodesTests : IDisposable
+    {
+        private readonly TempDirectory _tmp = new TempDirectory();
+        private readonly List<EnrollmentEvent> _events = new List<EnrollmentEvent>();
+        private readonly object _eventsGate = new object();
+        private readonly GatherRuleExecutor _executor;
+
+        private const string AbsentPath =
+            "HKLM\\SOFTWARE\\AutopilotMonitorTests\\DefinitelyAbsent_7e3a1f4b-0000-0000-0000-000000000000";
+
+        public GatherRuleExecutorEnrichErrorCodesTests()
+        {
+            var logger = new AgentLogger(_tmp.Path, AgentLogLevel.Info);
+            _executor = new GatherRuleExecutor(
+                "sess", "tenant",
+                evt => { lock (_eventsGate) _events.Add(evt); },
+                logger)
+            {
+                UnrestrictedMode = true
+            };
+        }
+
+        public void Dispose()
+        {
+            _executor.Dispose();
+            _tmp.Dispose();
+        }
+
+        private EnrollmentEvent SingleEvent()
+        {
+            lock (_eventsGate) return Assert.Single(_events);
+        }
+
+        private bool WaitForEventCount(int count, int timeoutMs = 10000)
+        {
+            var sw = Stopwatch.StartNew();
+            while (sw.ElapsedMilliseconds < timeoutMs)
+            {
+                lock (_eventsGate) if (_events.Count >= count) return true;
+                Thread.Sleep(25);
+            }
+            lock (_eventsGate) return _events.Count >= count;
+        }
+
+        private static GatherRule StartupRule(bool enrichErrorCodes) => new GatherRule
+        {
+            RuleId = "GATHER-EEC-001",
+            Title = "enrich test",
+            CollectorType = "registry",
+            Target = AbsentPath,
+            Trigger = "startup",
+            OutputEventType = "gather_test",
+            Enabled = true,
+            EnrichErrorCodes = enrichErrorCodes,
+        };
+
+        [Fact]
+        public void StampRuleMarkers_AddsMarkerOnlyWhenOptedIn()
+        {
+            var optedIn = new Dictionary<string, object> { ["exitCode"] = "1603" };
+            GatherRuleExecutor.StampRuleMarkers(StartupRule(enrichErrorCodes: true), optedIn);
+            Assert.Equal(true, optedIn[Constants.GatherRuleDataKeys.EnrichErrorCodes]);
+
+            var defaultRule = new Dictionary<string, object> { ["exitCode"] = "1603" };
+            GatherRuleExecutor.StampRuleMarkers(StartupRule(enrichErrorCodes: false), defaultRule);
+            Assert.False(defaultRule.ContainsKey(Constants.GatherRuleDataKeys.EnrichErrorCodes));
+            Assert.Single(defaultRule);
+        }
+
+        [Fact]
+        public void ExecuteRule_StampsMarker_WhenRuleOptsIn()
+        {
+            _executor.UpdateRules(new List<GatherRule> { StartupRule(enrichErrorCodes: true) });
+
+            Assert.True(_executor.WaitForStartupRules(30));
+            Assert.True(WaitForEventCount(1));
+            var evt = SingleEvent();
+            Assert.Equal(GatherRuleExecutor.SourceName, evt.Source);
+            Assert.Equal(true, evt.Data[Constants.GatherRuleDataKeys.EnrichErrorCodes]);
+        }
+
+        [Fact]
+        public void ExecuteRule_LeavesPayloadUnchanged_ByDefault()
+        {
+            _executor.UpdateRules(new List<GatherRule> { StartupRule(enrichErrorCodes: false) });
+
+            Assert.True(_executor.WaitForStartupRules(30));
+            Assert.True(WaitForEventCount(1));
+            Assert.False(SingleEvent().Data.ContainsKey(Constants.GatherRuleDataKeys.EnrichErrorCodes));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogPatternPackLinearityTests.cs

@@ -311,6 +311,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
                 "[Win32App] Admin did NOT set mapping for lpExitCode: 1603 of app: " + Guid1,
                 new[] { "exitCode=1603", "id=" + Guid1 }
             };
+            // Win32AppInstaller.cs "[Win32App] lpExitCode is defined as {0}", enum AppReturnCodeType
+            // (identical 1.50–1.105).
+            yield return new object[]
+            {
+                "IME-EXITCODE-CLASS",
+                "[Win32App] lpExitCode is defined as SoftReboot",
+                new[] { "exitCodeClass=SoftReboot" }
+            };
             yield return new object[]
             {
                 "IME-GRS-SKIP",
@@ -361,6 +369,31 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
             }
         }
 
+        [Theory]
+        [InlineData("Success")]
+        [InlineData("SoftReboot")]
+        [InlineData("HardReboot")]
+        [InlineData("Retry")]
+        [InlineData("Failed")]
+        public void IME_EXITCODE_CLASS_captures_every_AppReturnCodeType_member(string member)
+        {
+            var m = Compile(Get("IME-EXITCODE-CLASS")).Match("[Win32App] lpExitCode is defined as " + member);
+            Assert.True(m.Success);
+            Assert.Equal(member, m.Groups["exitCodeClass"].Value);
+        }
+
+        [Fact]
+        public void IME_EXITCODE_CLASS_ignores_the_no_mapping_warning_and_raw_numeric_types()
+        {
+            // The default branch logs "... defined as {0}, fall into default now." and an admin
+            // type outside the enum prints as a raw number; neither is a class the app carries.
+            var regex = Compile(Get("IME-EXITCODE-CLASS"));
+            Assert.DoesNotMatch(regex, "[Win32App] lpExitCode is defined as 5, fall into default now.");
+            Assert.DoesNotMatch(regex, "[Win32App] lpExitCode is defined as SoftReboot, fall into default now.");
+            Assert.DoesNotMatch(regex, "[Win32App] lpExitCode is defined as 5");
+            Assert.DoesNotMatch(regex, "[Win32App] lpExitCode 3010");
+        }
+
         [Fact]
         public void PS_SCRIPT_CONTEXT_no_longer_fires_on_Win32App_detection_script_lines()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Ime/ImeLogTrackerExitCodeClassTests.cs

@@ -0,0 +1,248 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Shared.Models;
+using Newtonsoft.Json;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Ime
+{
+    /// <summary>
+    /// Return-code class of the installer exit code (IME "[Win32App] lpExitCode is defined as
+    /// {AppReturnCodeType}"): captured by the shipped IME-EXITCODE-CLASS pattern into
+    /// <see cref="AppPackageState.ExitCodeClass"/>, last value wins across a Retry loop, the
+    /// no-mapping/default-branch variants are ignored, and the value survives the agent
+    /// restart that a SoftReboot/HardReboot app causes (persistence round trip).
+    /// </summary>
+    public sealed class ImeLogTrackerExitCodeClassTests
+    {
+        private const string AppId = "5c95bf94-1cf4-4629-88d1-3f616e7a405c";
+
+        // ---------------------------------------------------------------- AppPackageState
+
+        [Fact]
+        public void UpdateExitCodeClass_last_value_wins_and_ignores_empty()
+        {
+            var pkg = new AppPackageState(AppId, 0);
+            Assert.Null(pkg.ExitCodeClass);
+
+            Assert.True(pkg.UpdateExitCodeClass("Retry"));
+            Assert.True(pkg.UpdateExitCodeClass(" Success "));
+            Assert.Equal("Success", pkg.ExitCodeClass);
+            Assert.False(pkg.UpdateExitCodeClass("Success"));
+            Assert.False(pkg.UpdateExitCodeClass(""));
+            Assert.False(pkg.UpdateExitCodeClass(null));
+            Assert.Equal("Success", pkg.ExitCodeClass);
+        }
+
+        [Fact]
+        public void ToEventData_carries_the_class_only_when_known()
+        {
+            var pkg = new AppPackageState(AppId, 0);
+            Assert.False(pkg.ToEventData().ContainsKey("exitCodeClass"));
+
+            pkg.UpdateExitCode("3010");
+            pkg.UpdateExitCodeClass("SoftReboot");
+            var data = pkg.ToEventData();
+            Assert.Equal("3010", data["exitCode"]);
+            Assert.Equal("SoftReboot", data["exitCodeClass"]);
+        }
+
+        [Fact]
+        public void Restore_round_trips_the_class()
+        {
+            var pkg = AppPackageState.Restore(
+                AppId, 0, "Contoso VPN",
+                AppRunAs.System, AppIntent.Install, AppTargeted.Device,
+                new HashSet<string>(),
+                AppInstallationState.Installed, true, 100, 0, 0,
+                exitCode: "3010", exitCodeClass: "SoftReboot");
+
+            Assert.Equal("SoftReboot", pkg.ExitCodeClass);
+        }
+
+        // ---------------------------------------------------------------- shipped pack, end to end
+
+        private static string FindRulesPatternDir()
+        {
+            var dir = new DirectoryInfo(AppContext.BaseDirectory);
+            while (dir != null)
+            {
+                var candidate = Path.Combine(dir.FullName, "rules", "ime-log-patterns");
+                if (Directory.Exists(candidate)) return candidate;
+                dir = dir.Parent;
+            }
+            throw new DirectoryNotFoundException($"Could not locate rules/ime-log-patterns walking up from {AppContext.BaseDirectory}");
+        }
+
+        /// <summary>The shipped pack, exactly as combine.js embeds it (sorted by file name).</summary>
+        private static List<ImeLogPattern> ShippedPack()
+            => Directory.GetFiles(FindRulesPatternDir(), "*.json")
+                .OrderBy(f => f, StringComparer.Ordinal)
+                .Select(f => JsonConvert.DeserializeObject<ImeLogPattern>(File.ReadAllText(f))!)
+                .ToList();
+
+        private static string Entry(string message, DateTime utcInstant)
+        {
+            // CMTrace line with a zero writer offset: the tracker reads the local time and
+            // resolves it against the reader zone; only freshness (< 24 h) matters here.
+            return $"<![LOG[{message}]LOG]!><time=\"{utcInstant:HH:mm:ss.fffffff}\" date=\"{utcInstant:M-d-yyyy}\" " +
+                   "component=\"IntuneManagementExtension\" context=\"\" type=\"1\" thread=\"1\" file=\"\">";
+        }
+
+        private sealed class Harness : IDisposable
+        {
+            private readonly TempDirectory _tmp = new TempDirectory();
+            public ImeLogTracker Tracker { get; }
+            public string StateDir { get; }
+            public DateTime Now { get; } = new DateTime(2026, 9, 6, 12, 0, 0, DateTimeKind.Utc);
+
+            public Harness()
+            {
+                StateDir = Path.Combine(_tmp.Path, "State");
+                Tracker = Build();
+            }
+
+            public ImeLogTracker Build()
+            {
+                var tracker = new ImeLogTracker(
+                    logFolder: _tmp.Path,
+                    patterns: ShippedPack(),
+                    logger: new AgentLogger(_tmp.Path, AgentLogLevel.Info),
+                    stateDirectory: StateDir);
+                // The historic-replay guard skips app-mutating actions for lines older than 24 h
+                // relative to "now": pin both so the CMTrace entries below are always fresh.
+                tracker.UtcNowProvider = () => Now;
+                return tracker;
+            }
+
+            public void Append(params string[] messages)
+            {
+                var lines = messages.Select((m, i) => Entry(m, Now.AddSeconds(-60 + i)));
+                File.AppendAllText(Path.Combine(_tmp.Path, "IntuneManagementExtension.log"),
+                    string.Join(Environment.NewLine, lines) + Environment.NewLine);
+            }
+
+            public Task Pass() => Tracker.CheckLogFilesAsync(CancellationToken.None);
+
+            public void Dispose()
+            {
+                Tracker.Dispose();
+                _tmp.Dispose();
+            }
+        }
+
+        private static string PhaseLine => "[Win32App] In EspPhase: DeviceSetup.";
+        private static string CurrentAppLine => @"[Win32App] SetCurrentDirectory: C:\Windows\IMECache\" + AppId + "_1";
+
+        [Fact]
+        public async Task Shipped_pattern_captures_the_class_for_the_current_app()
+        {
+            using var h = new Harness();
+            h.Tracker.PackageStates.Add(new AppPackageState(AppId, 0));
+            h.Append(
+                PhaseLine,          // activates the currentPhase pack (IME-EXITCODE, IME-EXITCODE-CLASS)
+                CurrentAppLine,     // IME-SET-CURRENT-4 → current app
+                "[Win32App] lpExitCode 3010",
+                "[Win32App] lpExitCode is defined as SoftReboot");
+
+            await h.Pass();
+
+            var pkg = h.Tracker.PackageStates.GetPackage(AppId);
+            Assert.NotNull(pkg);
+            Assert.Equal("3010", pkg!.ExitCode);
+            Assert.Equal("SoftReboot", pkg.ExitCodeClass);
+            Assert.NotEqual(AppInstallationState.Error, pkg.InstallationState);
+        }
+
+        [Fact]
+        public async Task Retry_loop_that_ends_in_success_reports_the_last_class()
+        {
+            using var h = new Harness();
+            h.Tracker.PackageStates.Add(new AppPackageState(AppId, 0));
+            h.Append(
+                PhaseLine, CurrentAppLine,
+                "[Win32App] lpExitCode 1618",
+                "[Win32App] lpExitCode is defined as Retry",
+                "[Win32App] lpExitCode 1618",
+                "[Win32App] lpExitCode is defined as Retry",
+                "[Win32App] lpExitCode 0",
+                "[Win32App] lpExitCode is defined as Success");
+
+            await h.Pass();
+
+            var pkg = h.Tracker.PackageStates.GetPackage(AppId)!;
+            Assert.Equal("0", pkg.ExitCode);
+            Assert.Equal("Success", pkg.ExitCodeClass);
+        }
+
+        [Fact]
+        public async Task Failed_class_still_drives_the_error_transition_and_carries_the_class()
+        {
+            // IME-EXITCODE-CLASS and IME-EXITCODE-MAPPED-FAILED both match the Failed line: the
+            // class is captured and the existing error path stays intact.
+            using var h = new Harness();
+            var pkg = new AppPackageState(AppId, 0);
+            pkg.UpdateState(AppInstallationState.Installing);
+            h.Tracker.PackageStates.Add(pkg);
+            h.Append(
+                PhaseLine, CurrentAppLine,
+                "[Win32App] lpExitCode 1603",
+                "[Win32App] lpExitCode is defined as Failed");
+
+            await h.Pass();
+
+            Assert.Equal(AppInstallationState.Error, pkg.InstallationState);
+            Assert.Equal("Failed", pkg.ExitCodeClass);
+            Assert.Equal("IME-EXITCODE-MAPPED-FAILED", pkg.ErrorPatternId);
+        }
+
+        [Fact]
+        public async Task Default_branch_and_raw_numeric_types_leave_the_class_unset()
+        {
+            using var h = new Harness();
+            h.Tracker.PackageStates.Add(new AppPackageState(AppId, 0));
+            h.Append(
+                PhaseLine, CurrentAppLine,
+                "[Win32App] lpExitCode 5",
+                "[Win32App] lpExitCode is defined as 5",
+                "[Win32App] lpExitCode is defined as 5, fall into default now.",
+                "[Win32App] Setting enforcementState as: Error with lpExitCode: 5 without mapping");
+
+            await h.Pass();
+
+            var pkg = h.Tracker.PackageStates.GetPackage(AppId)!;
+            Assert.Equal("5", pkg.ExitCode);
+            Assert.Null(pkg.ExitCodeClass);
+        }
+
+        [Fact]
+        public async Task Class_survives_the_state_round_trip_of_an_agent_restart()
+        {
+            // A SoftReboot/HardReboot app completes only after the reboot; the restarted agent
+            // must still know the class when the post-reboot Success line arrives.
+            using var h = new Harness();
+            h.Tracker.PackageStates.Add(new AppPackageState(AppId, 0));
+            h.Append(
+                PhaseLine, CurrentAppLine,
+                "[Win32App] lpExitCode 1641",
+                "[Win32App] lpExitCode is defined as HardReboot");
+            await h.Pass();
+            h.Tracker.SaveStateForTest();
+
+            using var restarted = h.Build();
+            restarted.LoadStateForTest();
+
+            var pkg = restarted.GetAllKnownPackageStates().Single(p => p.Id == AppId);
+            Assert.Equal("1641", pkg.ExitCode);
+            Assert.Equal("HardReboot", pkg.ExitCodeClass);
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Runtime/DiagnosticsPackageServiceTests.cs

@@ -903,5 +903,87 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Runtime
                 NtfsLinks.RemoveLink(link);
             }
         }
+
+        // ============================================================= packaging counters
+
+        [Fact]
+        public void BuildArchiveBytes_records_packaging_counters_by_reason_and_kind_without_paths()
+        {
+            using var rig = new Rig();
+            File.WriteAllText(Path.Combine(rig.StateFolder, "small.json"), "{}");
+            File.WriteAllText(Path.Combine(rig.StateFolder, "big-1.json"), new string('x', 64));
+            File.WriteAllText(Path.Combine(rig.StateFolder, "big-2.json"), new string('y', 64));
+            var blockedPath = @"C:\Windows\System32\config\SYSTEM";
+
+            var service = rig.Build(cfg => cfg.DiagnosticsLogPaths.Add(
+                new AutopilotMonitor.Shared.Models.DiagnosticsLogPath { Path = blockedPath }));
+            service.Budget = new DiagnosticsBudget { MaxSingleFileBytes = 16, MaxTotalUncompressedBytes = 1L << 30, MaxFileCount = 5000 };
+
+            Assert.Null(service.LastPackaging);
+            var bytes = service.BuildArchiveBytes(enrollmentSucceeded: true);
+
+            var stats = service.LastPackaging;
+            Assert.NotNull(stats);
+            Assert.True(stats!.Truncated);
+            Assert.Equal(2, stats.SkippedFiles);
+            Assert.Equal(2, stats.SkippedByReason["size"]);
+            Assert.Single(stats.SkippedByReason);
+            Assert.Equal(1, stats.ProblemsByKind["path-guard"]);
+            Assert.Single(stats.ProblemsByKind);
+            Assert.True(stats.IncludedFiles >= 1, "the small file must have been included");
+            Assert.True(stats.IncludedBytes >= 2);
+
+            // The ZIP still carries the per-file list; the counters never do.
+            Assert.NotNull(ReadZipEntryText(bytes, "_TRUNCATED.txt"));
+            foreach (var key in stats.SkippedByReason.Keys.Concat(stats.ProblemsByKind.Keys))
+            {
+                Assert.DoesNotContain("\\", key);
+                Assert.DoesNotContain(":", key);
+                Assert.DoesNotContain("/", key);
+            }
+        }
+
+        [Fact]
+        public void BuildArchiveBytes_reports_a_clean_build_as_not_truncated_with_empty_maps()
+        {
+            using var rig = new Rig();
+            File.WriteAllText(Path.Combine(rig.StateFolder, "snapshot.json"), "{}");
+
+            var service = rig.Build();
+            service.BuildArchiveBytes(enrollmentSucceeded: true);
+
+            var stats = service.LastPackaging;
+            Assert.NotNull(stats);
+            Assert.False(stats!.Truncated);
+            Assert.Equal(0, stats.SkippedFiles);
+            Assert.Empty(stats.SkippedByReason);
+            Assert.Empty(stats.ProblemsByKind);
+            Assert.True(stats.IncludedFiles >= 1);
+        }
+
+        [Fact]
+        public void BuildArchiveBytes_counts_a_rejected_source_folder_as_a_problem()
+        {
+            using var rig = new Rig();
+            using var outside = new TempDirectory();
+            File.WriteAllText(Path.Combine(outside.Path, "snapshot.json"), "{}");
+            var link = Path.Combine(rig.Tmp.Path, "StateLink");
+            NtfsLinks.CreateJunction(link, outside.Path);
+
+            try
+            {
+                var service = rig.Build(sectionFolderOverrides: new Dictionary<string, string> { ["AgentState"] = link });
+                service.BuildArchiveBytes(enrollmentSucceeded: true);
+
+                // The section is walked once per search pattern (11 patterns) but the folder
+                // failed once — the counter says so.
+                Assert.Equal(1, service.LastPackaging!.ProblemsByKind["folder-rejected"]);
+                Assert.False(service.LastPackaging.Truncated);
+            }
+            finally
+            {
+                NtfsLinks.RemoveLink(link);
+            }
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/ProvisioningStatusTrackerPendingFailureTests.cs

@@ -0,0 +1,92 @@
+using System;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
+{
+    /// <summary>
+    /// <see cref="ProvisioningStatusTracker.TryGetPendingFailureArgs"/> exposes the registry
+    /// failure detail while its settle window is open and nothing once the window has fired —
+    /// the coordinator reads it when a Shell-Core failure terminalises first (session 683f1eff).
+    /// </summary>
+    public sealed class ProvisioningStatusTrackerPendingFailureTests
+    {
+        private static readonly DateTime Fixed = new DateTime(2026, 9, 8, 18, 11, 2, DateTimeKind.Utc);
+
+        private const string InProgressJson = @"{
+            ""categorySucceeded"": null,
+            ""AppsSubcategory"": {""subcategoryState"":""inProgress"",""subcategoryStatusText"":""Apps (Working)""}
+        }";
+        private const string AppsFailedJson = @"{
+            ""categorySucceeded"": null,
+            ""AppsSubcategory"": {""subcategoryState"":""failed"",""subcategoryStatusText"":""Apps (0x80070652)""}
+        }";
+
+        private sealed class Fixture : IDisposable
+        {
+            public TempDirectory Tmp { get; } = new TempDirectory();
+            public ProvisioningStatusTracker Tracker { get; }
+
+            public Fixture()
+            {
+                var post = new InformationalEventPost(new FakeSignalIngressSink(), new VirtualClock(Fixed));
+                var logger = new AgentLogger(Tmp.Path, AgentLogLevel.Info);
+                Tracker = new ProvisioningStatusTracker(
+                    sessionId: "S1",
+                    tenantId: "T1",
+                    post: post,
+                    logger: logger,
+                    appxScanner: new FakeAppxDeploymentFailureScanner(),
+                    backgroundDispatcher: action => action());
+            }
+
+            public void Dispose()
+            {
+                Tracker.Dispose();
+                Tmp.Dispose();
+            }
+        }
+
+        [Fact]
+        public void Nothing_pending_before_any_failure()
+        {
+            using var f = new Fixture();
+            Assert.Null(f.Tracker.TryGetPendingFailureArgs());
+
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", InProgressJson);
+            Assert.Null(f.Tracker.TryGetPendingFailureArgs());
+        }
+
+        [Fact]
+        public void Armed_settle_window_exposes_the_registry_detail()
+        {
+            using var f = new Fixture();
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", InProgressJson);
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", AppsFailedJson);
+
+            var pending = f.Tracker.TryGetPendingFailureArgs();
+
+            Assert.NotNull(pending);
+            Assert.Equal("Provisioning_DeviceSetup_Apps_Failed", pending!.FailureType);
+            Assert.Equal("0x80070652", pending.ErrorCode);
+            Assert.Equal("Apps", pending.FailedSubcategory);
+            Assert.Equal("DeviceSetup", pending.Category);
+        }
+
+        [Fact]
+        public void Expired_settle_window_leaves_nothing_pending()
+        {
+            using var f = new Fixture();
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", InProgressJson);
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", AppsFailedJson);
+
+            f.Tracker.TriggerSettleTimerForTest("DeviceSetupCategory.Status");
+
+            Assert.Null(f.Tracker.TryGetPendingFailureArgs());
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/SystemSignals/WindowsUpdateTrackerTests.cs

@@ -243,12 +243,23 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
         }
 
         [Fact]
-        public void DecodeHResult_KnownAndUnknown()
+        public void ResolveHResultSymbol_ReadsTheSharedCatalog()
         {
-            Assert.Equal("WU_E_ALL_UPDATES_FAILED", WindowsUpdateTracker.DecodeHResult(0x80240022));
-            Assert.Equal("CBS_E_INSTALLERS_FAILED", WindowsUpdateTracker.DecodeHResult(0x800F0922));
-            Assert.Equal("S_OK", WindowsUpdateTracker.DecodeHResult(0x00000000));
-            Assert.Equal("WU_E_UNKNOWN", WindowsUpdateTracker.DecodeHResult(0x8888DEAD));
+            Assert.Equal("WU_E_ALL_UPDATES_FAILED", WindowsUpdateTracker.ResolveHResultSymbol(0x80240022));
+            Assert.Equal("CBS_E_INSTALLERS_FAILED", WindowsUpdateTracker.ResolveHResultSymbol(0x800F0922));
+            Assert.Equal("ERROR_TIMEOUT", WindowsUpdateTracker.ResolveHResultSymbol(0x800705B4));
+            Assert.Equal("S_OK", WindowsUpdateTracker.ResolveHResultSymbol(0x00000000));
+            Assert.Equal("WU_E_UNKNOWN", WindowsUpdateTracker.ResolveHResultSymbol(0x8888DEAD));
+        }
+
+        [Fact]
+        public void ResolveHResultSymbol_FallsBackWhenTheCatalogHasNoSymbolOrThrows()
+        {
+            // An entry without a symbol (IME/Intune paraphrases) still yields the sentinel.
+            Assert.Equal("WU_E_UNKNOWN", WindowsUpdateTracker.ResolveHResultSymbol(0x87D1041C));
+            // A catalog load failure is decoration lost, never an event lost.
+            Assert.Equal("WU_E_UNKNOWN", WindowsUpdateTracker.ResolveHResultSymbol(0x80240022, _ => throw new InvalidOperationException("catalog")));
+            Assert.Equal("S_OK", WindowsUpdateTracker.ResolveHResultSymbol(0, _ => throw new InvalidOperationException("catalog")));
         }
 
         // ---------------------------------------------------------------------------

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Telemetry/Gather/GuardrailsParityTests.cs

@@ -56,6 +56,31 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Telemetry.Gather
                 LoadEmbeddedGuardrails()["maxCommandLength"]!.Value<int>());
         }
 
+        [Fact]
+        public void User_profile_prefixes_are_all_accepted_by_the_loader()
+        {
+            // The loader drops entries outside AppData\Local / AppData\Roaming (the hard block
+            // would never release them anyway). A dropped entry is invisible at runtime — it
+            // just never matches — so a typo in the JSON must fail here instead.
+            var json = LoadEmbeddedGuardrails()["userProfileFilePrefixes"]?.ToObject<string[]>()
+                       ?? new string[0];
+
+            Assert.Equal(
+                json.Select(p => p.Trim().TrimEnd('\\')).OrderBy(p => p),
+                GatherRuleGuards.AllowedUserProfileFilePrefixes.OrderBy(p => p));
+        }
+
+        [Fact]
+        public void User_profile_prefixes_stay_under_the_hard_blocks_exception()
+        {
+            Assert.All(
+                GatherRuleGuards.AllowedUserProfileFilePrefixes,
+                prefix => Assert.Contains(
+                    GatherRuleGuards.AllowedUserProfileSubdirs,
+                    subdir => prefix.StartsWith(subdir, System.StringComparison.OrdinalIgnoreCase) &&
+                              (prefix.Length == subdir.Length || prefix[subdir.Length] == '\\')));
+        }
+
         [Fact]
         public void Blocked_event_log_channels_match_code_constants()
         {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/DecisionStepProcessorUploadPathTests.cs

@@ -11,6 +11,7 @@ using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
 using AutopilotMonitor.DecisionCore.State;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/EnrollmentOrchestratorPart2EmissionTests.cs

@@ -8,6 +8,7 @@ using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
 using AutopilotMonitor.DecisionCore.Signals;
 using AutopilotMonitor.DecisionCore.State;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 #pragma warning disable xUnit1031
 
@@ -42,7 +43,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             // items must be a whiteglove_resumed event.
             Assert.DoesNotContain(
                 rig.Uploader.Received.SelectMany(b => b),
-                item => item.Kind == AutopilotMonitor.Agent.V2.Core.Transport.Telemetry.TelemetryItemKind.Event &&
+                item => item.Kind == TelemetryItemKind.Event &&
                         item.PayloadJson != null &&
                         item.PayloadJson.Contains("\"whiteglove_resumed\""));
         }
@@ -75,7 +76,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             var resumedEvents = rig.Uploader.Received
                 .SelectMany(b => b)
                 .Where(item =>
-                    item.Kind == AutopilotMonitor.Agent.V2.Core.Transport.Telemetry.TelemetryItemKind.Event &&
+                    item.Kind == TelemetryItemKind.Event &&
                     item.PayloadJson != null &&
                     item.PayloadJson.Contains("\"whiteglove_resumed\""))
                 .ToList();

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/EnrollmentOrchestratorTests.cs

@@ -265,6 +265,42 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Orchestration
             sut.Stop();
         }
 
+        [Fact]
+        public void Deadline_fired_late_keeps_the_due_time_as_stamp_and_carries_it_in_the_payload()
+        {
+            // A deadline that was due while the device slept (or the agent was down) fires only
+            // afterwards. The signal keeps the due time as OccurredAtUtc (D-238: the outage must not
+            // become session duration) and repeats it in the payload so the stale-fire guards
+            // identify the incarnation independently of the stamp.
+            using var rig = new EnrollmentOrchestratorRig(At);
+            var sut = rig.Build();
+            sut.Start();
+
+            var dueAt = At.AddMinutes(-5);
+            var scheduler = GetScheduler(sut);
+            scheduler.Schedule(new ActiveDeadline(
+                name: "hello_safety",
+                dueAtUtc: dueAt,
+                firesSignalKind: DecisionSignalKind.DeadlineFired,
+                firesPayload: new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = "hello_safety" }));
+
+            var signalLog = GetSignalLog(sut);
+            Assert.True(SpinWait.SpinUntil(() => ContainsDeadlineFired(signalLog), 3000));
+
+            DecisionSignal? fired = null;
+            foreach (var sig in signalLog.ReadAll())
+            {
+                if (sig.Kind == DecisionSignalKind.DeadlineFired) { fired = sig; break; }
+            }
+            Assert.NotNull(fired);
+            Assert.Equal(dueAt, fired!.OccurredAtUtc);
+            Assert.NotNull(fired.Payload);
+            Assert.Equal("hello_safety", fired.Payload![SignalPayloadKeys.Deadline]);
+            Assert.Equal(dueAt.ToString("O"), fired.Payload[SignalPayloadKeys.DeadlineDueAtUtc]);
+
+            sut.Stop();
+        }
+
         // ========================================================================= Quarantine
 
         [Fact]

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/RecoveryPathTests.cs

@@ -15,6 +15,7 @@ using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
 using AutopilotMonitor.DecisionCore.State;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 #pragma warning disable xUnit1031
 

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Orchestration/SignalIngressUploadPathTests.cs

@@ -9,6 +9,7 @@ using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.Signals;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 #pragma warning disable xUnit1031
 

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/SignalAdapters/ImeLogTrackerAdapterTests.cs

@@ -282,8 +282,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
                 errorPatternId: null,
                 errorDetail: null,
                 errorCode: null,
-                exitCode: null,
+                exitCode: "0",
                 hresultFromWin32: null,
+                exitCodeClass: "Success",
                 appVersion: "11.2.1787.0",
                 appType: "WinGet",
                 attemptNumber: 1,
@@ -293,6 +294,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
 
             var info = Assert.Single(f.InfoEvents(SharedEventTypes.AppInstallComplete));
             Assert.Equal("app-xyz", info.Payload!["appId"]);
+            // Installer outcome surfaces on the terminal event even when the app succeeded: the
+            // return-code class is the only evidence of a SoftReboot/HardReboot mapping and the
+            // number says which code was mapped (IME-EXITCODE-CLASS, ANALYZE-APP-018).
+            Assert.Equal("Success", info.Payload["exitCodeClass"]);
+            Assert.Equal("0", info.Payload["exitCode"]);
             Assert.Equal("Company Portal", info.Payload["appName"]);
             Assert.Equal("Installed", info.Payload["state"]);
             Assert.Equal("Install", info.Payload["intent"]);
@@ -331,6 +337,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
                 errorCode: "60001",
                 exitCode: "60001",
                 hresultFromWin32: "-2146964895",
+                exitCodeClass: "Failed",
                 attemptNumber: 1,
                 detectionResult: "NotDetected");
 
@@ -340,6 +347,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.SignalAdapters
             Assert.Equal("true", info.Payload!["isError"]);
             Assert.Equal("IME-ERROR-UNMAPPED-EXIT", info.Payload["errorPatternId"]);
             Assert.Equal("60001", info.Payload["errorCode"]);
+            Assert.Equal("60001", info.Payload["exitCode"]);
+            Assert.Equal("Failed", info.Payload["exitCodeClass"]);
             Assert.Equal("-2146964895", info.Payload["hresultFromWin32"]);
             Assert.Equal(EventSeverity.Error.ToString(), info.Payload[SignalPayloadKeys.Severity]);
             // Codex review follow-up (P1): an unrelated ErrorPatternId (here a regular

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Telemetry/Signals/TelemetrySignalEmitterTests.cs

@@ -5,6 +5,7 @@ using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using AutopilotMonitor.DecisionCore.Signals;
 using Newtonsoft.Json.Linq;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Telemetry.Signals
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Telemetry/Transitions/TelemetryTransitionEmitterTests.cs

@@ -8,6 +8,7 @@ using AutopilotMonitor.DecisionCore.Engine;
 using AutopilotMonitor.DecisionCore.State;
 using Newtonsoft.Json.Linq;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Telemetry.Transitions
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Termination/EnrollmentTerminationHandlerTests.cs

@@ -1701,5 +1701,86 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Termination
                 rig.PromotionCalls[0].failureType);
             Assert.Null(rig.PromotionCalls[0].errorCode);
         }
+
+        // ============================================================= packaging counters on the diag events
+
+        [Fact]
+        public void Handle_diagnostics_uploaded_carries_packaging_counters_when_the_packager_reported_them()
+        {
+            using var rig = new Rig();
+            rig.State = new DecisionStateBuilder(DecisionState.CreateInitial("S1", "T1")) { Stage = SessionStage.Completed }.Build();
+            rig.DiagnosticsResult = new DiagnosticsUploadResult
+            {
+                BlobName = "diag-blob.zip",
+                Packaging = new DiagnosticsPackagingStats
+                {
+                    IncludedFiles = 412,
+                    IncludedBytes = 123456,
+                    SkippedFiles = 3,
+                    SkippedByReason = new Dictionary<string, int> { ["size"] = 2, ["total"] = 1 },
+                    ProblemsByKind = new Dictionary<string, int> { ["copy"] = 1 },
+                },
+            };
+            var cfg = rig.BuildConfig(diagEnabled: true, diagMode: "Always", selfDestruct: false);
+
+            rig.Build(cfg).Handle(sender: null!,
+                Args(EnrollmentTerminationReason.DecisionTerminalStage, EnrollmentTerminationOutcome.Succeeded, SessionStage.Completed));
+
+            var uploaded = rig.DataOf("diagnostics_uploaded");
+            Assert.NotNull(uploaded);
+            Assert.Equal(true, uploaded!["truncated"]);
+            Assert.Equal(412, uploaded["includedFiles"]);
+            Assert.Equal(123456L, uploaded["includedBytes"]);
+            Assert.Equal(3, uploaded["skippedFiles"]);
+            var byReason = Assert.IsType<Dictionary<string, int>>(uploaded["skippedByReason"]);
+            Assert.Equal(2, byReason["size"]);
+            Assert.Equal(1, byReason["total"]);
+            var problems = Assert.IsType<Dictionary<string, int>>(uploaded["problemsByKind"]);
+            Assert.Equal(1, problems["copy"]);
+            // Counters only — no key or value carries a file path.
+            foreach (var kv in uploaded)
+                Assert.False(kv.Value is string s && (s.Contains("\\") || s.Contains("/")) && kv.Key != "sasUrlPrefix",
+                    $"payload key {kv.Key} looks like a path: {kv.Value}");
+        }
+
+        [Fact]
+        public void Handle_diagnostics_upload_failed_after_a_build_carries_the_counters_too()
+        {
+            using var rig = new Rig();
+            rig.State = new DecisionStateBuilder(DecisionState.CreateInitial("S1", "T1")) { Stage = SessionStage.Failed }.Build();
+            rig.DiagnosticsResult = new DiagnosticsUploadResult
+            {
+                ErrorCode = "upload_5xx",
+                Packaging = new DiagnosticsPackagingStats { IncludedFiles = 40, IncludedBytes = 1000 },
+            };
+            var cfg = rig.BuildConfig(diagEnabled: true, diagMode: "Always", selfDestruct: false);
+
+            rig.Build(cfg).Handle(sender: null!,
+                Args(EnrollmentTerminationReason.DecisionTerminalStage, EnrollmentTerminationOutcome.Failed, SessionStage.Failed));
+
+            var failed = rig.DataOf("diagnostics_upload_failed");
+            Assert.NotNull(failed);
+            Assert.Equal("upload_5xx", (string)failed!["errorCode"]);
+            Assert.Equal(false, failed["truncated"]);
+            Assert.Equal(40, failed["includedFiles"]);
+            Assert.Empty(Assert.IsType<Dictionary<string, int>>(failed["skippedByReason"]));
+        }
+
+        [Fact]
+        public void Handle_diagnostics_events_omit_the_counters_when_no_package_was_built()
+        {
+            using var rig = new Rig();
+            rig.State = new DecisionStateBuilder(DecisionState.CreateInitial("S1", "T1")) { Stage = SessionStage.Completed }.Build();
+            rig.DiagnosticsResult = new DiagnosticsUploadResult { BlobName = "diag-blob.zip" };
+            var cfg = rig.BuildConfig(diagEnabled: true, diagMode: "Always", selfDestruct: false);
+
+            rig.Build(cfg).Handle(sender: null!,
+                Args(EnrollmentTerminationReason.DecisionTerminalStage, EnrollmentTerminationOutcome.Succeeded, SessionStage.Completed));
+
+            var uploaded = rig.DataOf("diagnostics_uploaded");
+            Assert.NotNull(uploaded);
+            Assert.False(uploaded!.ContainsKey("truncated"));
+            Assert.False(uploaded.ContainsKey("skippedByReason"));
+        }
     }
 }

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/BackendTelemetryUploaderControlSignalsTests.cs

@@ -6,6 +6,7 @@ using System.Net.Http;
 using System.Threading;
 using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/BackendTelemetryUploaderLoggingTests.cs

@@ -8,6 +8,7 @@ using AutopilotMonitor.Agent.V2.Core.Logging;
 using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
 using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/BackendTelemetryUploaderTests.cs

@@ -7,6 +7,7 @@ using System.Threading.Tasks;
 using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using Newtonsoft.Json.Linq;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/TelemetrySpoolTests.cs

@@ -4,6 +4,7 @@ using System.Text;
 using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
 using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/TelemetryUploadOrchestratorTests.cs

@@ -4,6 +4,7 @@ using System.Threading.Tasks;
 using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
 using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using Xunit;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
 {

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Transport/TelemetryWireContractTests.cs

@@ -0,0 +1,250 @@
+#nullable enable
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Reflection;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using AutopilotMonitor.Agent.V2.Core.Telemetry.Events;
+using AutopilotMonitor.Agent.V2.Core.Telemetry.Signals;
+using AutopilotMonitor.Agent.V2.Core.Telemetry.Transitions;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Telemetry.Events;
+using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.DecisionCore.State;
+using AutopilotMonitor.Shared;
+using AutopilotMonitor.Shared.Models;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Linq;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Transport
+{
+    /// <summary>
+    /// The agent → backend wire contract of <c>POST /api/agent/telemetry</c>, proven from the
+    /// WRITER side. <see cref="TelemetryItemDto"/> (Shared) is the one class both ends serialise;
+    /// <see cref="TelemetryItem.ToWire"/> is the only mapping onto it.
+    /// <list type="bullet">
+    ///   <item>Round trip + reflection: every DTO property is populated by <c>ToWire()</c> and
+    ///   survives Newtonsoft defaults — a DTO field added without a mapping fails here.</item>
+    ///   <item>Frozen body: the real batch serialiser's output for one item per
+    ///   <see cref="TelemetryItemKind"/> is pinned under <c>tests/fixtures/telemetry-wire/</c>.
+    ///   The backend's <c>TelemetryWireFixtureTests</c> reads the same files and demands zero
+    ///   rejections, so a rename on either side breaks a test until both sides and the fixture
+    ///   agree. Regenerate with <c>AM_WRITE_WIRE_FIXTURES=1</c>.</item>
+    ///   <item>Poison body: the exact 422 shape the backend writes (pinned there by
+    ///   <c>TelemetryWireFixtureTests</c>) is parsed as an item-level poison signal here.</item>
+    /// </list>
+    /// </summary>
+    public sealed class TelemetryWireContractTests
+    {
+        private const string TenantId = "a1b2c3d4-e5f6-7890-abcd-ef1234567890";
+        private const string SessionId = "b2c3d4e5-f6a7-8901-bcde-f12345678901";
+        private const string FixtureFile = "agent-v2.json";
+
+        private static readonly DateTime At = new DateTime(2026, 4, 20, 10, 0, 0, DateTimeKind.Utc);
+
+        private static TelemetryItem FullyPopulatedItem() =>
+            new TelemetryItem(
+                kind: TelemetryItemKind.DecisionTransition,
+                partitionKey: $"{TenantId}_{SessionId}",
+                rowKey: "0000000007",
+                telemetryItemId: 42,
+                sessionTraceOrdinal: 7,
+                payloadJson: "{\"StepIndex\":7}",
+                requiresImmediateFlush: true,
+                enqueuedAtUtc: At,
+                retryCount: 3);
+
+        // ============================================================ ToWire mapping
+
+        [Fact]
+        public void ToWire_round_trips_every_property_through_Newtonsoft_defaults()
+        {
+            var item = FullyPopulatedItem();
+
+            var json = JsonConvert.SerializeObject(item.ToWire());
+            var dto = JsonConvert.DeserializeObject<TelemetryItemDto>(json)!;
+
+            Assert.Equal("DecisionTransition", dto.Kind);
+            Assert.Equal(item.PartitionKey, dto.PartitionKey);
+            Assert.Equal(item.RowKey, dto.RowKey);
+            Assert.Equal(item.TelemetryItemId, dto.TelemetryItemId);
+            Assert.Equal(item.SessionTraceOrdinal, dto.SessionTraceOrdinal);
+            Assert.Equal(item.PayloadJson, dto.PayloadJson);
+            Assert.Equal(item.RequiresImmediateFlush, dto.RequiresImmediateFlush);
+            Assert.Equal(item.EnqueuedAtUtc, dto.EnqueuedAtUtc);
+            Assert.Equal(DateTimeKind.Utc, dto.EnqueuedAtUtc.Kind);
+            Assert.Equal(item.RetryCount, dto.RetryCount);
+        }
+
+        [Fact]
+        public void ToWire_populates_every_TelemetryItemDto_property()
+        {
+            // A DTO property that ToWire() does not set keeps its default — this catches a field
+            // added to the wire type without a mapping (the backend would read the default forever).
+            var dto = FullyPopulatedItem().ToWire();
+
+            var unset = typeof(TelemetryItemDto)
+                .GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                .Where(p => IsDefault(p.GetValue(dto), p.PropertyType))
+                .Select(p => p.Name)
+                .ToList();
+
+            Assert.True(unset.Count == 0,
+                "TelemetryItem.ToWire() leaves these TelemetryItemDto properties at their default: " + string.Join(", ", unset));
+        }
+
+        [Fact]
+        public void TelemetryItemDto_properties_mirror_TelemetryItem()
+        {
+            var itemProps = typeof(TelemetryItem).GetProperties(BindingFlags.Public | BindingFlags.Instance)
+                .ToDictionary(p => p.Name, p => p.PropertyType);
+
+            foreach (var dtoProp in typeof(TelemetryItemDto).GetProperties(BindingFlags.Public | BindingFlags.Instance))
+            {
+                Assert.True(itemProps.TryGetValue(dtoProp.Name, out var itemType),
+                    $"TelemetryItemDto.{dtoProp.Name} has no counterpart on TelemetryItem");
+                var expected = dtoProp.Name == nameof(TelemetryItemDto.Kind) ? typeof(TelemetryItemKind) : dtoProp.PropertyType;
+                Assert.True(itemType == expected,
+                    $"TelemetryItemDto.{dtoProp.Name} is {dtoProp.PropertyType.Name}, TelemetryItem.{dtoProp.Name} is {itemType.Name}");
+            }
+        }
+
+        [Fact]
+        public void Every_kind_serialises_by_name_on_the_wire_and_on_the_spool_line()
+        {
+            foreach (var kind in TelemetryItemKinds.All)
+            {
+                var item = new TelemetryItem(kind, "T_S", "rk", 1, 1, "{}", false, At);
+
+                var wire = JObject.Parse(JsonConvert.SerializeObject(item.ToWire()));
+                Assert.Equal(kind.ToString(), (string?)wire["Kind"]);
+
+                // The spool line (TelemetryItemSerializer) has always written the NAME too; the enum's
+                // move to Shared must not turn it into an ordinal (a crash-restart rehydrates it).
+                var spool = JObject.Parse(TelemetryItemSerializer.Serialize(item));
+                Assert.Equal(kind.ToString(), (string?)spool["Kind"]);
+                Assert.Equal(kind, TelemetryItemSerializer.Deserialize(spool.ToString(Formatting.None)).Kind);
+
+                Assert.True(TelemetryItemKinds.TryParse(kind.ToString(), out var parsed));
+                Assert.Equal(kind, parsed);
+            }
+        }
+
+        // ============================================================ Frozen wire body
+
+        [Fact]
+        public void Frozen_wire_body_matches_the_current_serializer()
+        {
+            var items = OneItemPerKind();
+            Assert.Equal(TelemetryItemKinds.All.OrderBy(k => k), items.Select(i => i.Kind).Distinct().OrderBy(k => k));
+
+            var body = BackendTelemetryUploader.SerializeBatch(items);
+            var path = Path.Combine(RepoPaths.Fixtures("telemetry-wire"), FixtureFile);
+
+            if (Environment.GetEnvironmentVariable("AM_WRITE_WIRE_FIXTURES") == "1")
+            {
+                Directory.CreateDirectory(Path.GetDirectoryName(path)!);
+                File.WriteAllText(path, body + "\n", new UTF8Encoding(false));
+            }
+
+            Assert.True(File.Exists(path), "Missing wire fixture " + path + " — run this test with AM_WRITE_WIRE_FIXTURES=1 to create it.");
+            var frozen = File.ReadAllText(path).TrimEnd('\r', '\n');
+            Assert.True(string.Equals(frozen, body, StringComparison.Ordinal),
+                "The agent's telemetry wire body changed. If the change is intended, update the backend ingest " +
+                "(TelemetryWireFixtureTests must still dispatch every frozen body) and regenerate with " +
+                "AM_WRITE_WIRE_FIXTURES=1.\nExpected: " + frozen + "\nActual:   " + body);
+        }
+
+        /// <summary>
+        /// One item per kind through the REAL emitters (payload shapes are theirs, not hand-typed),
+        /// re-based onto fixed transport fields so the body is byte-stable.
+        /// </summary>
+        private static IReadOnlyList<TelemetryItem> OneItemPerKind()
+        {
+            using var tmp = new TempDirectory();
+            var transport = new FakeTelemetryTransport();
+            var counter = new EventSequenceCounter(new EventSequencePersistence(tmp.File("seq.json")));
+
+            new TelemetryEventEmitter(transport, counter, SessionId, TenantId).Emit(new EnrollmentEvent
+            {
+                EventId = "00000000-0000-4000-8000-000000000001",
+                EventType = Constants.EventTypes.AgentStarted,
+                Severity = EventSeverity.Info,
+                Source = "Agent",
+                Timestamp = At,
+                Phase = EnrollmentPhase.Unknown,
+                Message = "Agent started",
+                Data = new Dictionary<string, object> { ["agentVersion"] = "2.0.0" },
+            });
+
+            new TelemetrySignalEmitter(transport, SessionId, TenantId).Emit(new DecisionSignal(
+                sessionSignalOrdinal: 1,
+                sessionTraceOrdinal: 1,
+                kind: DecisionSignalKind.SessionStarted,
+                kindSchemaVersion: 1,
+                occurredAtUtc: At,
+                sourceOrigin: "Fixture",
+                evidence: new Evidence(EvidenceKind.Raw, "raw-1", "session start")));
+
+            new TelemetryTransitionEmitter(transport, SessionId, TenantId).Emit(new DecisionTransition(
+                stepIndex: 1,
+                sessionTraceOrdinal: 2,
+                signalOrdinalRef: 1,
+                occurredAtUtc: At,
+                trigger: "SessionStarted",
+                fromStage: SessionStage.Unknown,
+                toStage: SessionStage.AwaitingEspPhaseChange,
+                taken: true,
+                deadEndReason: null,
+                reducerVersion: "1.0.0"));
+
+            return transport.Enqueued
+                .Select(e => new TelemetryItem(e.Kind, e.PartitionKey, e.RowKey, e.TelemetryItemId, e.SessionTraceOrdinal,
+                    e.PayloadJson, e.RequiresImmediateFlush, At))
+                .ToList();
+        }
+
+        // ============================================================ Poison body
+
+        /// <summary>
+        /// The exact 422 body the backend writes for rejected items (pinned byte-for-byte in the
+        /// backend's TelemetryWireFixtureTests). camelCase because the backend serialises with
+        /// its wire options; the agent's parser accepts both casings.
+        /// </summary>
+        internal const string BackendPoisonBody =
+            "{\"error\":\"2 of 3 telemetry item(s) cannot be ingested (unknown Kind or unusable payload); they were not stored.\"," +
+            "\"code\":\"TelemetryItemsRejected\",\"correlationId\":\"cid-1\",\"poison\":true,\"rejectedRowKeys\":[\"rk-1\",\"rk-3\"]," +
+            "\"reason\":\"unknown_kind=1;unparseable=1\",\"received\":3,\"rejected\":2}";
+
+        [Fact]
+        public async Task Backend_422_poison_body_is_parsed_as_item_level_poison()
+        {
+            using var handler = new RecordingHttpMessageHandler().QueueStatus((HttpStatusCode)422, BackendPoisonBody);
+            using var http = new HttpClient(handler);
+            var sut = new BackendTelemetryUploader(http, baseUrl: "https://backend.example.invalid", tenantId: TenantId, agentVersion: "2.0.0");
+
+            var result = await sut.UploadBatchAsync(new[] { FullyPopulatedItem() }, CancellationToken.None);
+
+            Assert.False(result.Success);
+            Assert.True(result.IsPoison);
+            Assert.Equal(new[] { "rk-1", "rk-3" }, result.PoisonRowKeys);
+            Assert.Equal("unknown_kind=1;unparseable=1", result.ErrorReason);
+        }
+
+        private static bool IsDefault(object? value, Type type)
+        {
+            if (value == null) return true;
+            if (type == typeof(string)) return ((string)value).Length == 0;
+            var underlying = Nullable.GetUnderlyingType(type) ?? type;
+            return underlying.IsValueType && value.Equals(Activator.CreateInstance(underlying));
+        }
+    }
+}

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/AppPackageState.cs

@@ -99,6 +99,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         // Installer result codes (captured from lpExitCode / hResultFromWin32 log lines)
         public string ExitCode { get; private set; }
         public string HResultFromWin32 { get; private set; }
+        /// <summary>
+        /// Admin-defined return-code class of the last installer exit code: Success, SoftReboot,
+        /// HardReboot, Retry or Failed (IME's AppReturnCodeType, captured from the
+        /// "lpExitCode is defined as X" line by IME-EXITCODE-CLASS). Last value wins, so a Retry
+        /// loop that ends in Success reports Success.
+        /// </summary>
+        public string ExitCodeClass { get; private set; }
 
         // App metadata (captured from IME log patterns — used by App Dashboard / reports)
         /// <summary>Product version detected after install (e.g. "11.2.1787.0"). From ReportingManager DetectedIdentityVersion.</summary>
@@ -167,6 +174,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             int? progressPercent, long bytesDownloaded, long bytesTotal,
             string errorPatternId = null, string errorDetail = null, string errorCode = null,
             string exitCode = null, string hresultFromWin32 = null,
+            string exitCodeClass = null,
             long doFileSize = 0, long doTotalBytesDownloaded = 0,
             long doBytesFromPeers = 0, int doPercentPeerCaching = 0,
             long doBytesFromLanPeers = 0, long doBytesFromGroupPeers = 0,
@@ -195,6 +203,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 ErrorCode = errorCode,
                 ExitCode = exitCode,
                 HResultFromWin32 = hresultFromWin32,
+                ExitCodeClass = exitCodeClass,
                 InstallationStateLastChangedTicks = Stopwatch.GetTimestamp(),
                 DoFileSize = doFileSize,
                 DoTotalBytesDownloaded = doTotalBytesDownloaded,
@@ -302,6 +311,19 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             HResultFromWin32 = code;
         }
 
+        /// <summary>
+        /// Captures the return-code class (Success/SoftReboot/HardReboot/Retry/Failed) IME assigned
+        /// to the last exit code. Last value wins; empty values are ignored.
+        /// </summary>
+        public bool UpdateExitCodeClass(string exitCodeClass)
+        {
+            if (string.IsNullOrWhiteSpace(exitCodeClass)) return false;
+            var trimmed = exitCodeClass.Trim();
+            if (ExitCodeClass == trimmed) return false;
+            ExitCodeClass = trimmed;
+            return true;
+        }
+
         /// <summary>
         /// Updates the product version detected for this app (e.g. "11.2.1787.0").
         /// Only applies non-empty values so a later detection without version cannot wipe it.
@@ -547,6 +569,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 data["exitCode"] = ExitCode;
             if (!string.IsNullOrEmpty(HResultFromWin32))
                 data["hresultFromWin32"] = HResultFromWin32;
+            if (!string.IsNullOrEmpty(ExitCodeClass))
+                data["exitCodeClass"] = ExitCodeClass;
 
             // App metadata fields (emitted whenever available so ingest can merge them).
             if (!string.IsNullOrEmpty(AppVersion))

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.LogProcessing.cs

@@ -491,7 +491,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             "imeshutdown", "espphasedetected", "setcurrentapp",
             "updatestateinstalled", "updatestatedownloading", "updatestateinstalling",
             "updatestateskipped", "updatestateerror", "updatestatepostponed",
-            "captureexitcode", "capturehresult", "captureappversion",
+            "captureexitcode", "capturehresult", "captureexitcodeclass", "captureappversion",
             "captureapptypewinget", "captureapptypemsi", "captureattemptnumber",
             "capturedetectionresult", "esptrackstatus", "policiesdiscovered",
             "ignorecompletedapp", "updatename", "updatewin32appstate",
@@ -715,6 +715,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                             _packageStates.GetPackage(_packageStates.CurrentPackageId)?.UpdateHResult(hresultVal);
                         break;
 
+                    case "captureexitcodeclass":
+                        // Return-code class of the exit code captured just before (IME logs the
+                        // number, then "lpExitCode is defined as <class>"). Same current-app
+                        // addressing as captureExitCode; last value wins across a Retry loop.
+                        var exitCodeClassVal = match.Groups["exitCodeClass"]?.Value;
+                        if (!string.IsNullOrEmpty(exitCodeClassVal) && !string.IsNullOrEmpty(_packageStates.CurrentPackageId))
+                            _packageStates.GetPackage(_packageStates.CurrentPackageId)?.UpdateExitCodeClass(exitCodeClassVal);
+                        break;
+
                     case "captureappversion":
                         var appVersionVal = match.Groups["appVersion"]?.Value;
                         if (!string.IsNullOrEmpty(id) && !string.IsNullOrEmpty(appVersionVal))

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeLogTracker.cs

@@ -223,7 +223,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
             return true;
         }
 
-        private const int MaxScriptOutputLength = 2048;
+        // Script stdout kept per event. Measured over 1,486 script outputs in the fleet
+        // (2026-08-25..09-08): median 39, p90 644, max 1,501 chars -- the maximum being our own
+        // one-stage bootstrap, and nothing ever hit the previous 2,048 cap. The two-stage
+        // bootstrap then added a ~460-char loader preamble to that maximum and started
+        // truncating the one output an operator actually reads. 8,192 leaves room for the
+        // realistic worst case (download retries plus relax logging, ~2,700) and stays 4x below
+        // the 32K-char Table Storage property limit that bounds the event downstream. Growth
+        // driver is the number of log lines the bootstrap chain writes, so re-measure before
+        // adding a chatty step rather than raising this again.
+        private const int MaxScriptOutputLength = 8192;
         private const int MaxMultiLineBufferLines = 100;
         // Size cap for ONE entry — a single physical line (enforced by BoundedLineReader before
         // the line is materialized) and an assembled multiline entry alike. Any process able to
@@ -1241,6 +1250,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 ErrorCode = p.ErrorCode,
                 ExitCode = p.ExitCode,
                 HResultFromWin32 = p.HResultFromWin32,
+                ExitCodeClass = p.ExitCodeClass,
                 DoFileSize = p.DoFileSize,
                 DoTotalBytesDownloaded = p.DoTotalBytesDownloaded,
                 DoBytesFromPeers = p.DoBytesFromPeers,
@@ -1270,6 +1280,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
                 p.ProgressPercent, p.BytesDownloaded, p.BytesTotal,
                 errorPatternId: p.ErrorPatternId, errorDetail: p.ErrorDetail, errorCode: p.ErrorCode,
                 exitCode: p.ExitCode, hresultFromWin32: p.HResultFromWin32,
+                exitCodeClass: p.ExitCodeClass,
                 doFileSize: p.DoFileSize, doTotalBytesDownloaded: p.DoTotalBytesDownloaded,
                 doBytesFromPeers: p.DoBytesFromPeers, doPercentPeerCaching: p.DoPercentPeerCaching,
                 doBytesFromLanPeers: p.DoBytesFromLanPeers, doBytesFromGroupPeers: p.DoBytesFromGroupPeers,

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/Ime/ImeTrackerStatePersistence.cs

@@ -190,6 +190,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.Ime
         // Installer result codes
         public string ExitCode { get; set; }
         public string HResultFromWin32 { get; set; }
+        // Return-code class of the last exit code (null on state files written before the field
+        // existed) - must survive the reboot a SoftReboot/HardReboot app asks for.
+        public string ExitCodeClass { get; set; }
 
         // Delivery Optimization telemetry
         public long DoFileSize { get; set; }

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/EspAndHelloTracker.cs

@@ -44,6 +44,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         private readonly Func<bool> _userEspAppsSettledProbe;
         private readonly Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> _starvedUserEspAppsProbe;
         private readonly Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> _packageStatesProbe;
+        // Session 683f1eff: registry failure detail still sitting in an open settle window,
+        // consulted when a Shell-Core failure terminalises first (see OnShellCoreEspFailureDetected).
+        private readonly Func<EspFailureDetectedEventArgs> _pendingEspFailureProbe;
 
         // Session caa6cf50 gate-starvation fix (2026-06-11) — fire-once guard for the
         // user-ESP-apps-settled AccountSetup synthesis (see MaybeSynthesizeAccountSetupComplete).
@@ -174,8 +177,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         /// late "Installing-→-Error" promotion can classify the failure correctly
         /// AND refuse to promote when the failure originated outside the Apps
         /// subcategory (a non-Apps HRESULT does not describe per-app outcome).
-        /// Null when no HRESULT-carrying ESP failure has fired (or all observed
-        /// failures came from ShellCoreTracker, which has no HRESULT surface).
+        /// Null when no registry-derived failure detail has been observed — neither from
+        /// a settle window that expired nor from one a Shell-Core failure inherited.
         /// </summary>
         public Termination.EspTerminalFailureSnapshot LastEspTerminalFailure { get; private set; }
 
@@ -243,7 +246,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             Func<bool> accountSetupActivityProbe = null,
             Func<bool> userEspAppsSettledProbe = null,
             Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> starvedUserEspAppsProbe = null,
-            Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> packageStatesProbe = null)
+            Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> packageStatesProbe = null,
+            Func<EspFailureDetectedEventArgs> pendingEspFailureProbe = null)
         {
             _sessionId = sessionId ?? throw new ArgumentNullException(nameof(sessionId));
             _tenantId = tenantId ?? throw new ArgumentNullException(nameof(tenantId));
@@ -277,6 +281,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             // provisioning tracker name not-completed apps on an Apps-subcategory failure.
             _packageStatesProbe = packageStatesProbe
                 ?? (() => Array.Empty<Ime.AppPackageState>());
+            // Test seam: defaults to the provisioning tracker's open settle window (null when
+            // none is armed or the tracker is not running, e.g. Device Preparation).
+            _pendingEspFailureProbe = pendingEspFailureProbe
+                ?? (() => _provisioningTracker?.TryGetPendingFailureArgs());
         }
 
         /// <summary>
@@ -658,6 +666,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         internal void TriggerEspExitedForTest(DateTime occurredAtUtc) =>
             OnEspExited(this, new EspExitedEventArgs(occurredAtUtc));
 
+        // Test seam for a Shell-Core 62407 failure — drives the coordinator forwarder including
+        // the pending-settle inheritance, without a real ShellCoreTracker.
+        internal void TriggerShellCoreEspFailureForTest(string failureType) =>
+            OnShellCoreEspFailureDetected(this, failureType);
+
         // Test seam for HelloWizardStarted — same contract as TriggerEspExitedForTest.
         internal void TriggerHelloWizardStartedForTest(DateTime occurredAtUtc) =>
             OnHelloWizardStarted(this, new HelloWizardStartedEventArgs(occurredAtUtc));
@@ -673,33 +686,56 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         // Forwarder for ShellCoreTracker (event-log-derived ESP failures, e.g. Shell-Core 62407
         // failure descriptions). Source-event timestamp is mirrored so the adapter can stamp the
         // DecisionSignal with the historical instant on backfill. ShellCoreTracker has no HRESULT
-        // surface, so only FailureType is set on the args.
+        // surface; the registry detail is inherited from an open settle window (see below).
         private void OnShellCoreEspFailureDetected(object sender, string failureType)
         {
             LastEventOccurredAtUtc = (sender as ShellCoreTracker)?.LastEventOccurredAtUtc;
             try
             {
-                EspFailureDetected?.Invoke(this, new EspFailureDetectedEventArgs(failureType));
+                EspFailureDetected?.Invoke(this, BuildShellCoreFailureArgs(failureType));
             }
             catch (Exception ex) { _logger.Error($"Error forwarding ShellCore EspFailureDetected for '{failureType}'", ex); }
             finally { LastEventOccurredAtUtc = null; }
         }
 
-        // Forwarder for ProvisioningStatusTracker (registry-derived ESP failures). Args carry the
-        // full failure detail (FailureType, ErrorCode, FailedSubcategory, Category) extracted
-        // from the failed subcategory's statusText. Provisioning has no source-event timestamp
-        // surfaced today, so the adapter falls back to clock.
-        private void OnProvisioningEspFailureDetected(object sender, EspFailureDetectedEventArgs args)
+        // Session 683f1eff: the Shell-Core 62407 failure usually lands INSIDE the provisioning
+        // tracker's 30-s settle window — after the registry named the failed subcategory and its
+        // HRESULT, before the settle timer would have forwarded them. The engine terminalises on
+        // the first EspTerminalFailure and the agent stops seconds later, so whatever this signal
+        // carries is all the terminal event, the backend FailureReason and the termination-time
+        // app classification ever see (a third of all ESP terminal failures took this path). The
+        // pending detail is inherited here; FailureType stays the Shell-Core value because that
+        // is the signal that actually terminalised.
+        private EspFailureDetectedEventArgs BuildShellCoreFailureArgs(string failureType)
+        {
+            EspFailureDetectedEventArgs pending = null;
+            try { pending = _pendingEspFailureProbe(); }
+            catch (Exception ex) { _logger.Warning($"EspAndHelloTracker: pending ESP failure probe threw: {ex.Message}"); }
+
+            if (pending == null)
+                return new EspFailureDetectedEventArgs(failureType);
+
+            RecordTerminalFailureSnapshot(pending);
+            _logger.Info(
+                $"EspAndHelloTracker: Shell-Core failure '{failureType}' inherits the pending provisioning failure detail " +
+                $"(category={pending.Category ?? "n/a"}, failedSubcategory={pending.FailedSubcategory ?? "n/a"}, " +
+                $"errorCode={pending.ErrorCode ?? "n/a"})");
+            return new EspFailureDetectedEventArgs(
+                failureType,
+                errorCode: pending.ErrorCode,
+                failedSubcategory: pending.FailedSubcategory,
+                category: pending.Category,
+                likelyCulpritApps: pending.LikelyCulpritApps);
+        }
+
+        // Session 080edee9 follow-up + Codex review (P2/P3) — snapshot the full failure context
+        // (HRESULT + failedSubcategory + category) so EnrollmentTerminationHandler can read it on
+        // the terminal-failure pathway. Only update when the args carry at least one of the three
+        // fields, so a bare Shell-Core failure cannot wipe out the registry snapshot. Deliberately
+        // NOT gated on ErrorCode alone — a non-Apps subcategory failure without HRESULT is still
+        // useful for downstream "should we promote?" gating.
+        private void RecordTerminalFailureSnapshot(EspFailureDetectedEventArgs args)
         {
-            LastEventOccurredAtUtc = null;
-            // Session 080edee9 follow-up + Codex review (P2/P3) — snapshot the full
-            // failure context (HRESULT + failedSubcategory + category) before
-            // forwarding so EnrollmentTerminationHandler can read it on the terminal-
-            // failure pathway. Only update when the args carry at least one of the
-            // three fields, so a later ShellCore-derived failure (which has none of
-            // them) cannot wipe out the registry snapshot. We deliberately do NOT
-            // gate on ErrorCode alone — a non-Apps subcategory failure without
-            // HRESULT is still useful for downstream "should we promote?" gating.
             if (!string.IsNullOrEmpty(args?.ErrorCode)
                 || !string.IsNullOrEmpty(args?.FailedSubcategory)
                 || !string.IsNullOrEmpty(args?.Category))
@@ -709,6 +745,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                     failedSubcategory: args.FailedSubcategory,
                     category: args.Category);
             }
+        }
+
+        // Forwarder for ProvisioningStatusTracker (registry-derived ESP failures). Args carry the
+        // full failure detail (FailureType, ErrorCode, FailedSubcategory, Category) extracted
+        // from the failed subcategory's statusText. Provisioning has no source-event timestamp
+        // surfaced today, so the adapter falls back to clock.
+        private void OnProvisioningEspFailureDetected(object sender, EspFailureDetectedEventArgs args)
+        {
+            LastEventOccurredAtUtc = null;
+            RecordTerminalFailureSnapshot(args);
             try
             {
                 EspFailureDetected?.Invoke(this, args);

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/ProvisioningStatusTracker.cs

@@ -80,6 +80,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             "AccountSetupCategory.Status"
         };
 
+        // Order in which TryGetPendingFailureArgs resolves concurrently armed settle windows.
+        private static readonly string[] PendingFailurePreference =
+        {
+            "DeviceSetupCategory.Status",
+            "AccountSetupCategory.Status",
+            "DevicePreparationCategory.Status"
+        };
+
         private readonly AgentLogger _logger;
         private readonly string _sessionId;
         private readonly string _tenantId;
@@ -1711,6 +1719,29 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         internal void TriggerSettleTimerForTest(string categoryName)
             => OnProvisioningFailureSettleExpired(categoryName);
 
+        /// <summary>
+        /// The registry-derived failure detail of a settle window that is still open (armed,
+        /// not yet expired or retracted) — null when none is pending. Read by the coordinator
+        /// when a Shell-Core 62407 failure arrives inside the window, so the terminal signal
+        /// inherits HRESULT / failed subcategory / category instead of racing them away
+        /// (session 683f1eff). Windows fail one category at a time, but should two be armed
+        /// the device-phase category wins: it is the one the ESP page reports.
+        /// </summary>
+        internal EspFailureDetectedEventArgs TryGetPendingFailureArgs()
+        {
+            lock (_stateLock)
+            {
+                if (_provisioningFailureSettleArgs == null || _provisioningFailureSettleArgs.Count == 0)
+                    return null;
+                foreach (var category in PendingFailurePreference)
+                {
+                    if (_provisioningFailureSettleArgs.TryGetValue(category, out var args) && args != null)
+                        return args;
+                }
+                return null;
+            }
+        }
+
         private bool HasCategorySucceededChanged(string categoryName, bool? newValue)
         {
             if (!_lastCategorySucceeded.TryGetValue(categoryName, out var oldValue))

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/WindowsUpdateTracker.cs

@@ -9,6 +9,7 @@ using AutopilotMonitor.Agent.V2.Core.Logging;
 using AutopilotMonitor.Agent.V2.Core.Orchestration;
 using AutopilotMonitor.Shared;
 using AutopilotMonitor.Shared.Models;
+using AutopilotMonitor.Shared.Services;
 using Newtonsoft.Json;
 
 namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
@@ -303,7 +304,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
             if (TryNormalizeHResult(errorCode, out var hresultValue, out hresultHex))
             {
                 data["hresult"] = hresultHex;
-                data["hresultSymbol"] = DecodeHResult(hresultValue);
+                data["hresultSymbol"] = ResolveHResultSymbol(hresultValue);
             }
 
             var title = string.IsNullOrEmpty(updateTitle) ? "(unknown update)" : updateTitle;
@@ -462,36 +463,25 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
         }
 
         /// <summary>
-        /// Maps common Windows Update HRESULTs to their symbolic name. Not exhaustive — the full
-        /// catalog lives at
-        /// https://learn.microsoft.com/windows/deployment/update/windows-update-error-reference.
-        /// Unknown codes return "WU_E_UNKNOWN" so the raw <c>hresult</c> hex still carries the value.
+        /// Symbolic name of a WU HRESULT from the shared error-code catalog (WU, CBS, Win32 and
+        /// COM families). <c>S_OK</c> for zero, <c>WU_E_UNKNOWN</c> when the catalog has no symbol,
+        /// so the raw <c>hresult</c> hex still carries the value. A catalog load failure is
+        /// swallowed the same way: decoding is decoration and must never cost the event.
         /// </summary>
-        internal static string DecodeHResult(uint hresult)
+        internal static string ResolveHResultSymbol(uint hresult)
+            => ResolveHResultSymbol(hresult, code => ErrorCodeCatalog.TryLookup(code));
+
+        internal static string ResolveHResultSymbol(uint hresult, Func<string, ErrorCodeEntry> lookup)
         {
-            switch (hresult)
+            if (hresult == 0) return "S_OK";
+            try
             {
-                case 0x00000000: return "S_OK";
-                // WU agent codes (0x8024xxxx)
-                case 0x80240022: return "WU_E_ALL_UPDATES_FAILED";
-                case 0x8024200B: return "WU_E_UH_INSTALLERFAILURE";
-                case 0x80240020: return "WU_E_NO_INTERACTIVE_USER";
-                case 0x80240016: return "WU_E_INSTALL_NOT_ALLOWED";
-                case 0x8024000B: return "WU_E_CALL_CANCELLED";
-                case 0x8024000C: return "WU_E_NOOP";
-                case 0x80240FFF: return "WU_E_UNEXPECTED";
-                case 0x80248007: return "WU_E_DS_NODATA";
-                case 0x8024402C: return "WU_E_PT_WINHTTP_NAME_NOT_RESOLVED";
-                // Generic Win32 / HRESULT
-                case 0x80070005: return "E_ACCESSDENIED";
-                case 0x80070002: return "ERROR_FILE_NOT_FOUND";
-                case 0x80070003: return "ERROR_PATH_NOT_FOUND";
-                case 0x800705B4: return "ERROR_TIMEOUT";
-                // CBS / servicing (LCU install failures)
-                case 0x800F0831: return "CBS_E_STORE_CORRUPTION";
-                case 0x800F0922: return "CBS_E_INSTALLERS_FAILED";
-                case 0x800F0991: return "PSFX_E_MISSING_PAYLOAD_FILE";
-                default: return "WU_E_UNKNOWN";
+                var symbol = lookup("0x" + hresult.ToString("x8", CultureInfo.InvariantCulture))?.Symbol;
+                return string.IsNullOrEmpty(symbol) ? "WU_E_UNKNOWN" : symbol;
+            }
+            catch
+            {
+                return "WU_E_UNKNOWN";
             }
         }
 

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Runtime/DiagnosticsPackageService.cs

@@ -65,6 +65,44 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
 
         public static DiagnosticsUploadResult SkippedBy(string gate) =>
             new DiagnosticsUploadResult { Skipped = true, ErrorCode = gate };
+
+        /// <summary>
+        /// Counters of the archive build that produced (or preceded) this result; null when no
+        /// package was built (configuration gate, build exception). Surfaced into the
+        /// <c>diagnostics_uploaded</c> / <c>diagnostics_upload_failed</c> events so a truncated or
+        /// partially failed package is visible without opening the ZIP.
+        /// </summary>
+        public DiagnosticsPackagingStats Packaging { get; set; }
+    }
+
+    /// <summary>
+    /// What the packager included, skipped and failed on — as bounded counters only. File paths
+    /// stay inside the ZIP (<c>package-manifest.txt</c>, <c>_TRUNCATED.txt</c>): they can carry
+    /// user names, and a skip list has no upper bound while this payload must stay small no
+    /// matter how many files a cap rejected.
+    /// </summary>
+    public sealed class DiagnosticsPackagingStats
+    {
+        private static readonly IReadOnlyDictionary<string, int> Empty = new Dictionary<string, int>();
+
+        public int IncludedFiles { get; set; }
+        public long IncludedBytes { get; set; }
+
+        /// <summary>Files rejected by a cap or a reparse-point check (the <c>_TRUNCATED.txt</c> list).</summary>
+        public int SkippedFiles { get; set; }
+
+        /// <summary>True when at least one file was skipped — the same condition that writes <c>_TRUNCATED.txt</c>.</summary>
+        public bool Truncated => SkippedFiles > 0;
+
+        /// <summary>Skip count per reason: <c>size</c>, <c>count</c>, <c>total</c>, <c>reparse</c>, <c>resolved-outside-folder</c>.</summary>
+        public IReadOnlyDictionary<string, int> SkippedByReason { get; set; } = Empty;
+
+        /// <summary>
+        /// Packaging problems that are not cap skips, per kind: <c>path-guard</c> (configured path
+        /// refused), <c>no-user-session</c> (user-profile token without a signed-in user),
+        /// <c>folder-rejected</c>, <c>enumerate</c>, <c>open</c>, <c>copy</c>.
+        /// </summary>
+        public IReadOnlyDictionary<string, int> ProblemsByKind { get; set; } = Empty;
     }
 
     /// <summary>
@@ -134,6 +172,41 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                 Skipped.Add(new SkipRecord(path, reason, size));
 
             public bool HasSkips => Skipped.Count > 0;
+
+            // Non-cap problems (guard refusals, enumeration/open/copy failures) by kind — the
+            // manifest names the files, the event carries only these counts.
+            public Dictionary<string, int> Problems { get; } = new Dictionary<string, int>(StringComparer.Ordinal);
+            private readonly HashSet<string> _problemKeys = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+
+            /// <summary>
+            /// Counts one problem of <paramref name="kind"/>. A section is walked once per search
+            /// pattern, so a folder-level failure would otherwise be counted once per pattern —
+            /// pass the folder as <paramref name="dedupeKey"/> to count it once.
+            /// </summary>
+            public void RecordProblem(string kind, string dedupeKey = null)
+            {
+                if (dedupeKey != null && !_problemKeys.Add(kind + "|" + dedupeKey)) return;
+                Problems.TryGetValue(kind, out var n);
+                Problems[kind] = n + 1;
+            }
+
+            public DiagnosticsPackagingStats ToStats()
+            {
+                var byReason = new Dictionary<string, int>(StringComparer.Ordinal);
+                foreach (var s in Skipped)
+                {
+                    byReason.TryGetValue(s.Reason, out var n);
+                    byReason[s.Reason] = n + 1;
+                }
+                return new DiagnosticsPackagingStats
+                {
+                    IncludedFiles = FileCount,
+                    IncludedBytes = TotalBytes,
+                    SkippedFiles = Skipped.Count,
+                    SkippedByReason = byReason,
+                    ProblemsByKind = new Dictionary<string, int>(Problems, StringComparer.Ordinal),
+                };
+            }
         }
 
         private readonly struct SkipRecord
@@ -262,6 +335,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                 var zipFileName = $"AgentDiagnostics-{_configuration.SessionId}-{timestamp}{suffix}.zip";
 
                 var zipBytes = BuildArchiveBytes(enrollmentSucceeded);
+                var packaging = LastPackaging;
 
                 _logger.Info($"Diagnostics package created: {zipFileName} ({zipBytes.Length / 1024} KB)");
 
@@ -276,7 +350,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                 {
                     var errorCode = uploadUrlResponse?.Message ?? "Failed to get diagnostics upload URL from backend";
                     _logger.Warning($"Failed to get diagnostics upload URL from backend — skipping upload: {errorCode}");
-                    return new DiagnosticsUploadResult { ErrorCode = errorCode };
+                    return new DiagnosticsUploadResult { ErrorCode = errorCode, Packaging = packaging };
                 }
 
                 var sasUrlPrefix = BuildSasUrlPrefix(uploadUrlResponse.UploadUrl);
@@ -305,6 +379,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                         BlobName = persistedBlobName,
                         Destination = uploadUrlResponse.Destination,
                         SasUrlPrefix = sasUrlPrefix,
+                        Packaging = packaging,
                     };
                 }
 
@@ -313,6 +388,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                     Destination = uploadUrlResponse.Destination,
                     SasUrlPrefix = sasUrlPrefix,
                     ErrorCode = uploadErrorCode,
+                    Packaging = packaging,
                 };
             }
             catch (Exception ex)
@@ -351,6 +427,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
         // INSIDE the ZIP (field case: sessions a11102f4 / 3ae7528b, missing evtx undiagnosable).
         private StringBuilder _manifest;
 
+        /// <summary>Counters of the most recent <see cref="BuildArchiveBytes"/>; null before the first build.</summary>
+        internal DiagnosticsPackagingStats LastPackaging { get; private set; }
+
         private void ManifestLine(string text)
         {
             _manifest?.AppendLine($"[{DateTime.UtcNow:HH:mm:ss.fff}Z] {text}");
@@ -391,6 +470,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                         {
                             _logger.Warning($"Diagnostics path blocked by guard: {entry.Path}");
                             ManifestLine($"BLOCKED (path guard): {entry.Path}");
+                            tracker.RecordProblem("path-guard");
                             continue;
                         }
                         var expandedPath = UserProfileResolver.ExpandCustomTokens(entry.Path);
@@ -398,6 +478,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                         {
                             _logger.Warning($"Diagnostics path skipped (no user session for token): {entry.Path}");
                             ManifestLine($"SKIPPED (no user session for token): {entry.Path}");
+                            tracker.RecordProblem("no-user-session");
                             continue;
                         }
                         var folder = Path.GetDirectoryName(expandedPath);
@@ -427,6 +508,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                         WriteTruncatedMarker(archive, tracker);
                 }
 
+                LastPackaging = tracker.ToStats();
                 return ms.ToArray();
             }
         }
@@ -498,6 +580,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
             {
                 _logger.Warning($"Built-in diagnostics section skipped (no user session for token): {section.Id}");
                 ManifestLine($"BUILT-IN SKIPPED (no user session for token): {section.Id} '{section.SourceFolder}'");
+                tracker.RecordProblem("no-user-session");
                 return;
             }
 
@@ -584,6 +667,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                     {
                         _logger.Warning($"Diagnostics source folder rejected ({folderRejection}): {sourceFolder}");
                         ManifestLine($"FOLDER REJECTED ({folderRejection}): {sourceFolder} (pattern '{searchPattern}')");
+                        tracker.RecordProblem("folder-rejected", sourceFolder);
                     }
                     return;
                 }
@@ -597,6 +681,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                 {
                     _logger.Warning($"Failed to enumerate log files in {sourceFolder}: {ex.Message}");
                     ManifestLine($"ENUMERATION FAILED: {sourceFolder} (pattern '{searchPattern}'): {ex.Message}");
+                    tracker.RecordProblem("enumerate", sourceFolder);
                     return;
                 }
 
@@ -681,6 +766,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
             {
                 _logger.Warning($"Failed to add log file to diagnostics package: {file} - {ex.Message}");
                 ManifestLine($"FAILED (copy): {file}: {ex.Message}");
+                tracker.RecordProblem("copy");
             }
             finally
             {
@@ -720,6 +806,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Runtime
                 default:
                     _logger.Warning($"Failed to open {file}: {rejection}");
                     ManifestLine($"FAILED (open): {file}: {rejection}");
+                    tracker.RecordProblem("open");
                     break;
             }
             return null;

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/Collectors/LogParserCollector.cs

@@ -278,6 +278,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather.Collectors
                                 data["logFile"] = Path.GetFileName(filePath);
                                 data["ruleId"] = rule.RuleId;
                                 data["ruleTitle"] = rule.Title;
+                                GatherRuleExecutor.StampRuleMarkers(rule, data);
 
                                 var eventType = !string.IsNullOrEmpty(rule.OutputEventType)
                                     ? rule.OutputEventType
@@ -347,6 +348,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather.Collectors
                                 data["logFile"] = Path.GetFileName(filePath);
                                 data["ruleId"] = rule.RuleId;
                                 data["ruleTitle"] = rule.Title;
+                                GatherRuleExecutor.StampRuleMarkers(rule, data);
 
                                 var eventType = !string.IsNullOrEmpty(rule.OutputEventType)
                                     ? rule.OutputEventType

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/DiagnosticsPathGuards.cs

@@ -70,12 +70,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
             @"C:\Windows\System32\config",  // SAM, SECURITY, SYSTEM hives
         };
 
-        // Allowed subdirectories under a user profile (used with %LOGGED_ON_USER_PROFILE% token)
-        private static readonly string[] AllowedUserProfileSubdirs = new[]
-        {
-            @"AppData\Local",
-            @"AppData\Roaming",
-        };
+        // The allowed user-profile subdirectories and the vendor allowlist under them live in
+        // GatherRuleGuards, which owns the embedded guardrails.json — one copy for both guards.
 
         /// <summary>
         /// Returns true if the given path is allowed for diagnostics collection.
@@ -135,7 +131,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
                     (normalizedDir.Length == BlockedUsersPrefix.Length ||
                      normalizedDir[BlockedUsersPrefix.Length] == Path.DirectorySeparatorChar))
                 {
-                    if (!IsUserProfileSubpathAllowed(normalizedDir, userProfilePath))
+                    if (!GatherRuleGuards.IsUserProfileSubpathAllowed(normalizedDir, userProfilePath))
                         return false;
                 }
 
@@ -169,7 +165,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
                     }
                 }
 
-                return false;
+                // Vendor folders under the signed-in user's profile — same allowlist the file
+                // collectors use, since it answers the same question: which folders below a
+                // profile carry enrollment-relevant logs rather than the user's own data.
+                return GatherRuleGuards.IsUserProfilePathOnAllowlist(normalizedDir, userProfilePath);
             }
             catch
             {
@@ -178,38 +177,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
             }
         }
 
-        /// <summary>
-        /// Returns true if the normalized path falls under one of the allowed subdirectories
-        /// of the detected user profile (AppData\Local, AppData\Roaming).
-        /// Only applies when %LOGGED_ON_USER_PROFILE% was used to resolve the path.
-        /// </summary>
-        internal static bool IsUserProfileSubpathAllowed(string normalizedPath, string userProfilePath)
-        {
-            if (string.IsNullOrEmpty(userProfilePath))
-                return false;
-
-            try
-            {
-                var normalizedProfile = Path.GetFullPath(userProfilePath);
-                foreach (var subdir in AllowedUserProfileSubdirs)
-                {
-                    var allowedPrefix = Path.GetFullPath(Path.Combine(normalizedProfile, subdir));
-                    if (normalizedPath.StartsWith(allowedPrefix, StringComparison.OrdinalIgnoreCase) &&
-                        (normalizedPath.Length == allowedPrefix.Length ||
-                         normalizedPath[allowedPrefix.Length] == Path.DirectorySeparatorChar))
-                    {
-                        return true;
-                    }
-                }
-            }
-            catch
-            {
-                // Path normalization failure — deny
-            }
-
-            return false;
-        }
-
         /// <summary>
         /// Checks whether any component of the path (directories or file) is a symlink,
         /// junction, or other reparse point. Returns true if a reparse point is detected.

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleExecutor.cs

@@ -26,7 +26,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
         /// emits (executor, context guard events, collectors). The timeline feed uses it to keep
         /// gather output from re-triggering on_event rules.
         /// </summary>
-        public const string SourceName = "GatherRuleExecutor";
+        public const string SourceName = Constants.EventSources.GatherRuleExecutor;
 
         /// <summary>
         /// Upper bound on on_event executions per rule and session. on_event has no natural
@@ -496,6 +496,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
                     result["ruleId"] = rule.RuleId;
                     result["ruleTitle"] = rule.Title;
+                    StampRuleMarkers(rule, result);
 
                     var eventType = !string.IsNullOrEmpty(rule.OutputEventType) ? rule.OutputEventType : Constants.EventTypes.GatherResult;
 
@@ -537,6 +538,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
         // ===== Phase scope (ActivePhases / ActiveFromPhase) =====
 
+        /// <summary>
+        /// Injects the per-rule opt-in markers the backend reads at response time. Called after
+        /// the on_change hash is taken (the markers are rule config, not collected data) by the
+        /// executor and by collectors that emit directly (logparser).
+        /// </summary>
+        internal static void StampRuleMarkers(GatherRule rule, Dictionary<string, object> data)
+        {
+            if (rule.EnrichErrorCodes)
+                data[Constants.GatherRuleDataKeys.EnrichErrorCodes] = true;
+        }
+
         private static bool HasPhaseScope(GatherRule rule)
         {
             return (rule.ActivePhases != null && rule.ActivePhases.Count > 0)

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleGuards.cs

@@ -32,6 +32,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
         // -----------------------------------------------------------------------
         public static readonly IReadOnlyList<string> AllowedRegistryPrefixes;
         public static readonly IReadOnlyList<string> AllowedFilePrefixes;
+
+        /// <summary>
+        /// Folders under the signed-in user's profile that file collectors and
+        /// admin-configured diagnostics paths may read, RELATIVE to the profile root
+        /// (e.g. <c>AppData\Local\Vendor</c>). Resolved against the path
+        /// %LOGGED_ON_USER_PROFILE% produced, at match time — the profile name is not
+        /// known when the list is authored, which is why these entries cannot live in
+        /// <see cref="AllowedFilePrefixes"/> (matched literally against the expanded path).
+        /// </summary>
+        public static readonly IReadOnlyList<string> AllowedUserProfileFilePrefixes;
         public static readonly IReadOnlyList<string> AllowedWmiQueryPrefixes;
         public static readonly IReadOnlyCollection<string> AllowedCommands;
         public static readonly IReadOnlyList<string> AllowedEventLogChannels;
@@ -63,8 +73,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
             Path.GetFullPath(@"C:\Windows\System32\config"),  // SAM, SECURITY, SYSTEM hives
         };
 
-        // Allowed subdirectories under a user profile (used with %LOGGED_ON_USER_PROFILE% token)
-        private static readonly string[] AllowedUserProfileSubdirs = new[]
+        // The only subdirectories of a user profile the C:\Users hard block will ever
+        // release (used with %LOGGED_ON_USER_PROFILE%). Single copy for both guards —
+        // DiagnosticsPathGuards delegates here.
+        internal static readonly string[] AllowedUserProfileSubdirs = new[]
         {
             @"AppData\Local",
             @"AppData\Roaming",
@@ -118,6 +130,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
                     AllowedRegistryPrefixes = FlattenCategorized(obj, "registryPrefixes", "prefixes");
                     AllowedFilePrefixes = obj["filePrefixes"]?.ToObject<List<string>>() ?? new List<string>();
+                    AllowedUserProfileFilePrefixes = LoadUserProfilePrefixes(obj);
                     AllowedWmiQueryPrefixes = obj["wmiQueryPrefixes"]?.ToObject<List<string>>() ?? new List<string>();
 
                     var commands = FlattenCategorized(obj, "allowedCommands", "commands");
@@ -136,6 +149,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
             AllowedRegistryPrefixes = new List<string>();
             AllowedFilePrefixes = new List<string>();
+            AllowedUserProfileFilePrefixes = new List<string>();
             AllowedWmiQueryPrefixes = new List<string>();
             AllowedCommands = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
             AllowedEventLogChannels = new List<string>();
@@ -143,6 +157,43 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
             ResidualWmiPrefixes = new List<string>();
         }
 
+        /// <summary>
+        /// Reads <c>userProfileFilePrefixes</c> and drops every entry that is rooted, carries a
+        /// traversal, or does not sit under one of <see cref="AllowedUserProfileSubdirs"/>.
+        /// The C:\Users hard block releases nothing outside AppData, so such an entry could only
+        /// ever be dead text — dropping it at load keeps the list honest instead of silently
+        /// ineffective, and no configuration can widen the hard block's exception.
+        /// </summary>
+        private static List<string> LoadUserProfilePrefixes(JObject obj)
+        {
+            var raw = obj["userProfileFilePrefixes"]?.ToObject<List<string>>() ?? new List<string>();
+            var result = new List<string>();
+
+            foreach (var entry in raw)
+            {
+                if (string.IsNullOrWhiteSpace(entry))
+                    continue;
+
+                var trimmed = entry.Trim().TrimEnd('\\');
+                if (Path.IsPathRooted(trimmed))
+                    continue;
+                if (trimmed.IndexOf("..", StringComparison.Ordinal) >= 0)
+                    continue;
+
+                foreach (var subdir in AllowedUserProfileSubdirs)
+                {
+                    if (trimmed.StartsWith(subdir, StringComparison.OrdinalIgnoreCase) &&
+                        (trimmed.Length == subdir.Length || trimmed[subdir.Length] == '\\'))
+                    {
+                        result.Add(trimmed);
+                        break;
+                    }
+                }
+            }
+
+            return result;
+        }
+
         private static void DeriveWmiClassAllowlist(
             IReadOnlyList<string> entries,
             out HashSet<string> classes,
@@ -265,12 +316,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
 
             // C:\Users block always applies (even in unrestricted mode)
             // Exception: paths under <userProfilePath>\AppData\Local or AppData\Roaming
-            // are allowed when the %LOGGED_ON_USER_PROFILE% token was used.
+            // are allowed when the %LOGGED_ON_USER_PROFILE% token was used. The exception
+            // only LIFTS the block — in restricted mode the allowlist below still decides.
             if (normalizedPath.StartsWith(BlockedUsersPrefix, StringComparison.OrdinalIgnoreCase) &&
                 (normalizedPath.Length == BlockedUsersPrefix.Length ||
                  normalizedPath[BlockedUsersPrefix.Length] == Path.DirectorySeparatorChar))
             {
-                if (!DiagnosticsPathGuards.IsUserProfileSubpathAllowed(normalizedPath, userProfilePath))
+                if (!IsUserProfileSubpathAllowed(normalizedPath, userProfilePath))
                     return false;
             }
 
@@ -288,9 +340,61 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
             if (unrestrictedMode)
                 return true;
 
-            return AllowedFilePrefixes.Any(prefix =>
+            if (AllowedFilePrefixes.Any(prefix =>
                 normalizedPath.StartsWith(prefix, StringComparison.OrdinalIgnoreCase) &&
-                (normalizedPath.Length == prefix.Length || normalizedPath[prefix.Length] == '\\'));
+                (normalizedPath.Length == prefix.Length || normalizedPath[prefix.Length] == '\\')))
+            {
+                return true;
+            }
+
+            // Vendor folders under the signed-in user's profile. Only reachable when the rule
+            // spelled %LOGGED_ON_USER_PROFILE% and the resolver found an interactive user —
+            // a null profile denies, so a machine with nobody signed in cannot widen anything.
+            return IsUserProfilePathOnAllowlist(normalizedPath, userProfilePath);
+        }
+
+        /// <summary>
+        /// True when the normalized path sits under one of <see cref="AllowedUserProfileSubdirs"/>
+        /// of the detected user profile. This is the C:\Users hard block's only exception; it
+        /// releases the block and nothing else. A null profile denies.
+        /// </summary>
+        internal static bool IsUserProfileSubpathAllowed(string normalizedPath, string userProfilePath)
+            => AllowedUserProfileSubdirs.Any(subdir =>
+                   MatchesProfileRelativePrefix(normalizedPath, userProfilePath, subdir));
+
+        /// <summary>
+        /// True when the normalized path is admitted by an entry of
+        /// <see cref="AllowedUserProfileFilePrefixes"/> under the detected user profile.
+        /// </summary>
+        internal static bool IsUserProfilePathOnAllowlist(string normalizedPath, string userProfilePath)
+            => AllowedUserProfileFilePrefixes.Any(prefix =>
+                   MatchesProfileRelativePrefix(normalizedPath, userProfilePath, prefix));
+
+        /// <summary>
+        /// Segment-bounded match of <paramref name="normalizedPath"/> against
+        /// &lt;profile&gt;\&lt;relativePrefix&gt;. Both sides go through Path.GetFullPath, so a
+        /// traversal spelled into either one cannot slip past the boundary check.
+        /// </summary>
+        private static bool MatchesProfileRelativePrefix(
+            string normalizedPath, string userProfilePath, string relativePrefix)
+        {
+            if (string.IsNullOrEmpty(normalizedPath) || string.IsNullOrEmpty(userProfilePath))
+                return false;
+
+            try
+            {
+                var allowedPrefix = Path.GetFullPath(
+                    Path.Combine(Path.GetFullPath(userProfilePath), relativePrefix));
+
+                return normalizedPath.StartsWith(allowedPrefix, StringComparison.OrdinalIgnoreCase) &&
+                       (normalizedPath.Length == allowedPrefix.Length ||
+                        normalizedPath[allowedPrefix.Length] == Path.DirectorySeparatorChar);
+            }
+            catch
+            {
+                // Path normalization failure — deny.
+                return false;
+            }
         }
 
         /// <summary>

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/DeadlineFiredEventArgs.cs

@@ -9,9 +9,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
     /// <para>
     /// The orchestrator consumes this event and translates it into a synthetic
     /// <c>DeadlineFired</c>-<see cref="AutopilotMonitor.DecisionCore.Signals.DecisionSignal"/>
-    /// whose <c>OccurredAtUtc</c> equals the deadline's <see cref="ActiveDeadline.DueAtUtc"/>,
-    /// not the wall-clock firing time — so replay stays deterministic even if the agent
-    /// restarts long after the deadline has passed.
+    /// whose <c>OccurredAtUtc</c> equals the deadline's <see cref="ActiveDeadline.DueAtUtc"/>
+    /// (the policy instant the wait expired), with the due time repeated in the payload. The
+    /// firing clock is deliberately NOT the stamp: a timer due during Modern Standby or a
+    /// reboot fires only afterwards, and the outage would otherwise become session duration
+    /// (D-238).
     /// </para>
     /// </summary>
     public sealed class DeadlineFiredEventArgs : EventArgs

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/EnrollmentOrchestrator.cs

@@ -1,6 +1,7 @@
 #nullable enable
 using System;
 using System.Collections.Generic;
+using System.Globalization;
 using System.IO;
 using System.Threading;
 using System.Threading.Tasks;
@@ -1159,7 +1160,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
                 var evidence = new Evidence(
                     kind: EvidenceKind.Synthetic,
                     identifier: e.Deadline.Name,
-                    summary: $"deadline '{e.Deadline.Name}' fired at {e.Deadline.DueAtUtc:O}");
+                    summary: $"deadline '{e.Deadline.Name}' due {e.Deadline.DueAtUtc:O} fired at {e.FiredAtUtc:O}");
 
                 // The reducer reads the deadline name under SignalPayloadKeys.Deadline
                 // (see HandleDeadlineFiredV1 in DecisionEngine.Shared). Forward the
@@ -1180,7 +1181,15 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
                     payload[SignalPayloadKeys.Deadline] = e.Deadline.Name;
                 }
 
-                // OccurredAtUtc = DueAtUtc (not firedAt) — replay-determinism per DeadlineFiredEventArgs doc.
+                // OccurredAtUtc = DueAtUtc, not the firing clock (D-238). Every effect of the
+                // resulting step (phase_transition, enrollment_complete) is stamped with the signal
+                // time; a timer that came due during Modern Standby or a reboot fires only afterwards,
+                // and the firing clock would make the verdict — and the session duration — grow by
+                // the whole outage (measured: days for devices closed right after provisioning).
+                // The due time also travels in the payload so the stale-fire guards identify the
+                // deadline incarnation independently of the stamp.
+                payload[SignalPayloadKeys.DeadlineDueAtUtc] = e.Deadline.DueAtUtc.ToString("O", CultureInfo.InvariantCulture);
+
                 _ingress.Post(
                     kind: DecisionSignalKind.DeadlineFired,
                     occurredAtUtc: e.Deadline.DueAtUtc,

src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/IDeadlineScheduler.cs

@@ -39,7 +39,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Orchestration
         /// <summary>
         /// Wird vom Timer-Thread geraised, wenn ein Deadline fällig wird. Subscriber
         /// ist typischerweise der Orchestrator, der daraus ein synthetisches
-        /// <c>DeadlineFired</c>-Signal mit <c>OccurredAtUtc = deadline.DueAtUtc</c> erzeugt.
+        /// <c>DeadlineFired</c>-Signal mit <c>OccurredAtUtc = deadline.DueAtUtc</c> erzeugt; die
+        /// Fälligkeit reist zusätzlich im Payload (<c>SignalPayloadKeys.DeadlineDueAtUtc</c>).
         /// </summary>
         event EventHandler<DeadlineFiredEventArgs>? Fired;
 

src/Agent/AutopilotMonitor.Agent.V2.Core/SignalAdapters/ImeLogTrackerAdapter.cs

@@ -1628,6 +1628,15 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
             if (app.AttemptNumber > 0) data["attemptNumber"] = app.AttemptNumber.ToString(culture);
             if (!string.IsNullOrEmpty(app.DetectionResult)) data["detectionResult"] = app.DetectionResult!;
 
+            // Installer outcome of the last attempt (IME-EXITCODE + IME-EXITCODE-CLASS). The class
+            // is the admin's return-code mapping (Success/SoftReboot/HardReboot/Retry/Failed) and
+            // the only evidence that an app asked for a reboot; the number says which code was
+            // mapped (3010 vs 1641 vs custom). Both are known from the terminal lpExitCode lines
+            // only, so they surface on the terminal events - completed, postponed, skipped and
+            // failed alike - never on progress events.
+            if (!string.IsNullOrEmpty(app.ExitCodeClass)) data["exitCodeClass"] = app.ExitCodeClass!;
+            if (IsCompletedState(newState) && !string.IsNullOrEmpty(app.ExitCode)) data["exitCode"] = app.ExitCode!;
+
             // Plan §5 Fix 4c — per-app install-lifecycle timing. StartedAt appears on the
             // first Downloading/Installing/InProgress event; CompletedAt + DurationSeconds
             // light up on the terminal event. Values are omitted when not yet known so the
@@ -1644,7 +1653,6 @@ namespace AutopilotMonitor.Agent.V2.Core.SignalAdapters
                 if (!string.IsNullOrEmpty(app.ErrorPatternId)) data["errorPatternId"] = app.ErrorPatternId!;
                 if (!string.IsNullOrEmpty(app.ErrorDetail)) data["errorDetail"] = app.ErrorDetail!;
                 if (!string.IsNullOrEmpty(app.ErrorCode)) data["errorCode"] = app.ErrorCode!;
-                if (!string.IsNullOrEmpty(app.ExitCode)) data["exitCode"] = app.ExitCode!;
                 if (!string.IsNullOrEmpty(app.HResultFromWin32)) data["hresultFromWin32"] = app.HResultFromWin32!;
 
                 // Likely-stuck / detection-failure / install-failure classification: when the

src/Agent/AutopilotMonitor.Agent.V2.Core/Telemetry/Signals/TelemetrySignalEmitter.cs

@@ -4,6 +4,7 @@ using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using AutopilotMonitor.DecisionCore.Signals;
 using Newtonsoft.Json;
 using Newtonsoft.Json.Converters;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Telemetry.Signals
 {

src/Agent/AutopilotMonitor.Agent.V2.Core/Telemetry/Transitions/TelemetryTransitionEmitter.cs

@@ -4,6 +4,7 @@ using AutopilotMonitor.Agent.V2.Core.Transport.Telemetry;
 using AutopilotMonitor.DecisionCore.Engine;
 using Newtonsoft.Json;
 using Newtonsoft.Json.Converters;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Telemetry.Transitions
 {

src/Agent/AutopilotMonitor.Agent.V2.Core/Termination/EnrollmentTerminationHandler.cs

@@ -1007,6 +1007,17 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
             if (result != null && result.Success)
             {
                 _logger.Info($"EnrollmentTerminationHandler: diagnostics uploaded (blob={result.BlobName}).");
+                var data = new Dictionary<string, object>
+                {
+                    { "blobName", result.BlobName ?? string.Empty },
+                    // Tells the backend which storage the blob landed in so it can
+                    // stamp Session.DiagnosticsBlobDestination and route downloads
+                    // even after a future tenant destination switch. Empty when the
+                    // backend predates the field (agent falls through harmlessly).
+                    { "destination", result.Destination ?? string.Empty },
+                    { "sasUrlPrefix", result.SasUrlPrefix ?? string.Empty },
+                };
+                AppendPackagingStats(data, result.Packaging);
                 EmitEventSafe(new EnrollmentEvent
                 {
                     SessionId = _configuration.SessionId,
@@ -1015,17 +1026,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
                     Severity = EventSeverity.Info,
                     Source = "EnrollmentTerminationHandler",
                     Phase = EnrollmentPhase.Unknown,
-                    Message = $"Diagnostics package uploaded ({result.BlobName}).",
-                    Data = new Dictionary<string, object>
-                    {
-                        { "blobName", result.BlobName ?? string.Empty },
-                        // Tells the backend which storage the blob landed in so it can
-                        // stamp Session.DiagnosticsBlobDestination and route downloads
-                        // even after a future tenant destination switch. Empty when the
-                        // backend predates the field (agent falls through harmlessly).
-                        { "destination", result.Destination ?? string.Empty },
-                        { "sasUrlPrefix", result.SasUrlPrefix ?? string.Empty },
-                    },
+                    Message = $"Diagnostics package uploaded ({result.BlobName})."
+                              + (result.Packaging != null && result.Packaging.Truncated
+                                  ? $" Truncated: {result.Packaging.SkippedFiles} file(s) skipped by the packaging caps."
+                                  : string.Empty),
+                    Data = data,
                     ImmediateUpload = true,
                 });
             }
@@ -1033,6 +1038,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
             {
                 var errorCode = result?.ErrorCode ?? "null-result";
                 _logger.Warning($"EnrollmentTerminationHandler: diagnostics upload failed: {errorCode}.");
+                var data = new Dictionary<string, object>
+                {
+                    { "errorCode", errorCode },
+                    { "blobName", result?.BlobName ?? string.Empty },
+                    { "destination", result?.Destination ?? string.Empty },
+                };
+                AppendPackagingStats(data, result?.Packaging);
                 EmitEventSafe(new EnrollmentEvent
                 {
                     SessionId = _configuration.SessionId,
@@ -1042,17 +1054,30 @@ namespace AutopilotMonitor.Agent.V2.Core.Termination
                     Source = "EnrollmentTerminationHandler",
                     Phase = EnrollmentPhase.Unknown,
                     Message = $"Diagnostics upload failed: {errorCode}.",
-                    Data = new Dictionary<string, object>
-                    {
-                        { "errorCode", errorCode },
-                        { "blobName", result?.BlobName ?? string.Empty },
-                        { "destination", result?.Destination ?? string.Empty },
-                    },
+                    Data = data,
                     ImmediateUpload = true,
                 });
             }
         }
 
+        /// <summary>
+        /// Adds the packager's counters to a diagnostics event payload — counts only, never a
+        /// file path (paths live in the ZIP's manifest and may carry user names). Absent when no
+        /// package was built, so consumers treat the keys as optional.
+        /// </summary>
+        private static void AppendPackagingStats(Dictionary<string, object> data, DiagnosticsPackagingStats packaging)
+        {
+            if (packaging == null) return;
+            data["truncated"] = packaging.Truncated;
+            data["includedFiles"] = packaging.IncludedFiles;
+            data["includedBytes"] = packaging.IncludedBytes;
+            data["skippedFiles"] = packaging.SkippedFiles;
+            data["skippedByReason"] = new Dictionary<string, int>(
+                (IDictionary<string, int>)packaging.SkippedByReason ?? new Dictionary<string, int>(), StringComparer.Ordinal);
+            data["problemsByKind"] = new Dictionary<string, int>(
+                (IDictionary<string, int>)packaging.ProblemsByKind ?? new Dictionary<string, int>(), StringComparer.Ordinal);
+        }
+
         private void WriteEnrollmentCompleteMarker(EnrollmentTerminatedEventArgs args)
         {
             // On WhiteGlove Part 1 exit we keep the session alive for Part 2 — DO NOT write the

src/Agent/AutopilotMonitor.Agent.V2.Core/Transport/Telemetry/BackendTelemetryUploader.cs

@@ -395,12 +395,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
             }
         }
 
-        private static string SerializeBatch(IReadOnlyList<TelemetryItem> items)
+        /// <summary>
+        /// The batch body: a JSON array of <see cref="TelemetryItemDto"/> — the Shared class the
+        /// ingest deserialises — with Newtonsoft defaults (PascalCase, ISO-8601 UTC, Kind by name).
+        /// Internal so <c>TelemetryWireContractTests</c> can freeze the real output as a fixture.
+        /// </summary>
+        internal static string SerializeBatch(IReadOnlyList<TelemetryItem> items)
         {
-            // Newtonsoft PascalCase default + TelemetryItemKind carries [StringEnumConverter] →
-            // Backend routes by string "Event"/"Signal"/"DecisionTransition". Wire-format
-            // matches Plan §4.x M5 contract (PascalCase, StringEnum, ISO-8601 UTC).
-            return JsonConvert.SerializeObject(items, Formatting.None);
+            var wire = new TelemetryItemDto[items.Count];
+            for (var i = 0; i < items.Count; i++) wire[i] = items[i].ToWire();
+            return JsonConvert.SerializeObject(wire, Formatting.None);
         }
 
         private static byte[] CompressWithGzip(string text)

src/Agent/AutopilotMonitor.Agent.V2.Core/Transport/Telemetry/TelemetryItem.cs

@@ -1,5 +1,6 @@
 #nullable enable
 using System;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
 {
@@ -106,6 +107,26 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
         /// <summary>Anzahl der bisher fehlgeschlagenen Upload-Versuche. Wird vom Orchestrator incrementiert.</summary>
         public int RetryCount { get; }
 
+        /// <summary>
+        /// The wire shape of this item. <see cref="TelemetryItemDto"/> (Shared) is the ONE class both
+        /// ends serialise; this mapping is the only place the agent's validated model meets it.
+        /// <c>TelemetryWireContractTests</c> proves every DTO property is populated here and
+        /// freezes the resulting body under <c>tests/fixtures/telemetry-wire/</c> for the backend.
+        /// </summary>
+        public TelemetryItemDto ToWire() =>
+            new TelemetryItemDto
+            {
+                Kind = Kind.ToString(),
+                PartitionKey = PartitionKey,
+                RowKey = RowKey,
+                TelemetryItemId = TelemetryItemId,
+                SessionTraceOrdinal = SessionTraceOrdinal,
+                PayloadJson = PayloadJson,
+                RequiresImmediateFlush = RequiresImmediateFlush,
+                EnqueuedAtUtc = EnqueuedAtUtc,
+                RetryCount = RetryCount,
+            };
+
         /// <summary>Copy-with-incremented <see cref="RetryCount"/>. Immutable-Erhalt (§2.3 L.3).</summary>
         public TelemetryItem WithRetryIncremented() =>
             new TelemetryItem(

src/Agent/AutopilotMonitor.Agent.V2.Core/Transport/Telemetry/TelemetryItemDraft.cs

@@ -1,5 +1,6 @@
 #nullable enable
 using System;
+using AutopilotMonitor.Shared.Models;
 
 namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
 {

src/Agent/AutopilotMonitor.Agent.V2.Core/Transport/Telemetry/TelemetryItemKind.cs

@@ -1,29 +0,0 @@
-#nullable enable
-using Newtonsoft.Json;
-using Newtonsoft.Json.Converters;
-
-namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
-{
-    /// <summary>
-    /// Typ eines <see cref="TelemetryItem"/>. Plan §2.7a / L.10.
-    /// <para>
-    /// Drei getrennte Backend-Tabellen:
-    /// <see cref="Event"/> → <c>Events</c>,
-    /// <see cref="Signal"/> → <c>Signals</c>,
-    /// <see cref="DecisionTransition"/> → <c>DecisionTransitions</c>.
-    /// Der generische Transport routet auf Backend-Seite nach <c>Kind</c>.
-    /// </para>
-    /// <para>
-    /// String-serialisiert via <see cref="StringEnumConverter"/> — Backend-Routing darf
-    /// nicht von Integer-Ordering abhängen, das bei zukünftigen Erweiterungen bricht
-    /// (L.14 forward-compat).
-    /// </para>
-    /// </summary>
-    [JsonConverter(typeof(StringEnumConverter))]
-    public enum TelemetryItemKind
-    {
-        Event = 0,
-        Signal,
-        DecisionTransition,
-    }
-}

src/Agent/AutopilotMonitor.Agent.V2.Core/Transport/Telemetry/TelemetryItemSerializer.cs

@@ -2,6 +2,7 @@
 using System;
 using AutopilotMonitor.DecisionCore.Serialization;
 using Newtonsoft.Json;
+using Newtonsoft.Json.Converters;
 
 namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
 {
@@ -16,10 +17,25 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
     /// </summary>
     public static class TelemetryItemSerializer
     {
+        /// <summary>
+        /// DecisionCore settings plus a <see cref="StringEnumConverter"/>: <see cref="TelemetryItem.Kind"/>
+        /// is the only enum on a spool line and has always been written by NAME (<c>"Event"</c>),
+        /// which is also what the wire carries. The enum lives in Shared (no Newtonsoft there), so
+        /// the converter is registered here instead of as an attribute on the type.
+        /// </summary>
+        private static readonly JsonSerializerSettings SpoolSettings = CreateSpoolSettings();
+
+        private static JsonSerializerSettings CreateSpoolSettings()
+        {
+            var settings = DecisionCoreJsonSettings.Create();
+            settings.Converters.Add(new StringEnumConverter());
+            return settings;
+        }
+
         public static string Serialize(TelemetryItem item)
         {
             if (item == null) throw new ArgumentNullException(nameof(item));
-            return JsonConvert.SerializeObject(item, DecisionCoreJsonSettings.Shared);
+            return JsonConvert.SerializeObject(item, SpoolSettings);
         }
 
         public static TelemetryItem Deserialize(string line)
@@ -28,7 +44,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Transport.Telemetry
 
             try
             {
-                var result = JsonConvert.DeserializeObject<TelemetryItem>(line, DecisionCoreJsonSettings.Shared);
+                var result = JsonConvert.DeserializeObject<TelemetryItem>(line, SpoolSettings);
                 if (result == null)
                 {
                     throw new JsonSerializationException($"TelemetryItem deserialization produced null: {line}");

src/Agent/AutopilotMonitor.BootstrapMsi/Invoke-BootstrapDownload.ps1

@@ -1,55 +0,0 @@
-# Invoke-BootstrapDownload.ps1 - thin runner embedded in the Bootstrap MSI.
-#
-# The MSI is only a delivery vehicle (MDM LOB channel installs earlier than the IME
-# script/app batches during Autopilot Device Preparation). This runner downloads the
-# CURRENT Install-AutopilotMonitor.ps1 from the download endpoint and executes it, so
-# every piece of real bootstrap logic (guards, relax rules, agent download) stays
-# server-updatable without re-shipping the MSI.
-#
-# Fail-soft by design: the runner always exits 0 so a transient network failure never
-# marks the LOB install as failed; diagnostics go to bootstrap-msi.log.
-# ASCII only - no special characters in this file.
-
-$ErrorActionPreference = 'Stop'
-$baseDir = Join-Path $env:ProgramData 'AutopilotMonitor'
-$logDir  = Join-Path $baseDir 'Logs'
-New-Item -ItemType Directory -Force -Path $logDir | Out-Null
-$log = Join-Path $logDir 'bootstrap-msi.log'
-
-function Write-Log([string]$message) {
-    Add-Content -Path $log -Value ("[{0}] {1}" -f (Get-Date -Format 'yyyy-MM-dd HH:mm:ss'), $message)
-}
-
-try {
-    Write-Log "MSI bootstrap runner started (user=$env:USERNAME, pid=$PID)."
-
-    if (Test-Path 'HKLM:\SOFTWARE\AutopilotMonitor\Deployed') {
-        Write-Log 'Deployed marker present - skipping, another channel already installed the agent.'
-        exit 0
-    }
-
-    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
-    $url  = 'https://download.autopilotmonitor.com/agent/Install-AutopilotMonitor.ps1'
-    $dest = Join-Path $baseDir 'Install-AutopilotMonitor.ps1'
-
-    for ($attempt = 1; $attempt -le 3; $attempt++) {
-        try {
-            Invoke-WebRequest -UseBasicParsing -Uri $url -OutFile $dest
-            break
-        } catch {
-            Write-Log "Download attempt $attempt failed: $_"
-            if ($attempt -eq 3) { throw }
-            Start-Sleep -Seconds 10
-        }
-    }
-
-    Write-Log "Bootstrap script downloaded to $dest - executing."
-    # PS 5.1 file redirection (*>>) writes UTF-16LE, which garbles a log otherwise
-    # written via Add-Content (ANSI). Route through Add-Content for one encoding.
-    & $dest *>&1 | ForEach-Object { $_.ToString() } | Add-Content -Path $log
-    Write-Log "Bootstrap script finished (exit code $LASTEXITCODE)."
-    exit 0
-} catch {
-    Write-Log ("MSI bootstrap runner failed: " + ($_ | Out-String))
-    exit 0
-}

src/Agent/AutopilotMonitor.BootstrapMsi/Package.wxs

@@ -4,16 +4,19 @@
   LOB MSIs are installed by the OMA-DM stack (EnterpriseDesktopAppManagement CSP) during
   the first MDM sync, i.e. BEFORE/parallel to the Device Preparation SLDM app batch -
   earlier than any IME-delivered script (Batch 2) or Win32 app can run. The MSI itself
-  carries no bootstrap logic: it installs one runner script and executes it once. The
-  runner downloads the CURRENT server-hosted Install-AutopilotMonitor.ps1, keeping all
-  real logic updatable without re-shipping the MSI.
+  carries no bootstrap logic and no downloader of its own: it installs the SAME stage-1
+  loader that is assigned directly in Intune (scripts/Bootstrap/Start-AutopilotMonitor.ps1)
+  and runs it once. The loader downloads the current server-hosted
+  Install-AutopilotMonitor.ps1 and verifies its publisher before executing it, so all real
+  logic stays updatable without re-shipping the MSI, and both delivery channels share one
+  implementation.
 
   Build: wix build Package.wxs -arch x64 -o bin\AutopilotMonitor-Bootstrap.msi
 -->
 <Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
   <Package Name="Autopilot Monitor Bootstrap"
            Manufacturer="Autopilot Monitor"
-           Version="1.0.2"
+           Version="1.1.0"
            UpgradeCode="1fbe5515-d346-445c-b8b8-14ee79f97522"
            Scope="perMachine"
            Compressed="yes">
@@ -28,8 +31,13 @@
     </StandardDirectory>
 
     <ComponentGroup Id="MainComponents" Directory="INSTALLFOLDER">
-      <Component Id="RunnerScript" Guid="8c8e8962-719f-458b-b291-dd99d3f1dc30">
-        <File Id="RunnerPs1" Source="Invoke-BootstrapDownload.ps1" KeyPath="yes" />
+      <!-- Source is relative to the build working directory (the project dir), not to this
+           file. New component GUID because the key path changed. -->
+      <Component Id="RunnerScript" Guid="A972F561-01B5-400A-8C2A-47D12BA97DCA">
+        <File Id="RunnerPs1"
+              Source="..\..\..\scripts\Bootstrap\Start-AutopilotMonitor.ps1"
+              Name="Start-AutopilotMonitor.ps1"
+              KeyPath="yes" />
       </Component>
     </ComponentGroup>
 
@@ -38,11 +46,12 @@
     </Feature>
 
     <!-- Deferred + no-impersonate: runs as SYSTEM after files land. Return=ignore keeps
-         the LOB install green even if the runner hits a transient error (the runner is
-         additionally fail-soft itself); diagnostics live in bootstrap-msi.log. -->
+         the LOB install green even if the loader hits a transient error (the loader is
+         additionally fail-soft itself). -LogFileName keeps this channel distinguishable in
+         a diagnostics package; the diag tooling keys on that name. -->
     <CustomAction Id="RunBootstrap"
                   Directory="INSTALLFOLDER"
-                  ExeCommand="&quot;[System64Folder]WindowsPowerShell\v1.0\powershell.exe&quot; -NoProfile -ExecutionPolicy Bypass -File &quot;[INSTALLFOLDER]Invoke-BootstrapDownload.ps1&quot;"
+                  ExeCommand="&quot;[System64Folder]WindowsPowerShell\v1.0\powershell.exe&quot; -NoProfile -ExecutionPolicy Bypass -File &quot;[INSTALLFOLDER]Start-AutopilotMonitor.ps1&quot; -LogFileName bootstrap-msi.log"
                   Execute="deferred"
                   Impersonate="no"
                   Return="ignore" />

src/Agent/AutopilotMonitor.DecisionCore.Tests/DeadlineFireTimeStampTests.cs

@@ -0,0 +1,191 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using AutopilotMonitor.DecisionCore.Engine;
+using AutopilotMonitor.DecisionCore.Signals;
+using AutopilotMonitor.DecisionCore.State;
+using Xunit;
+
+namespace AutopilotMonitor.DecisionCore.Tests
+{
+    /// <summary>
+    /// The reducer identifies a deadline incarnation through the due time carried in the
+    /// payload (<see cref="SignalPayloadKeys.DeadlineDueAtUtc"/>), never through the signal
+    /// time: the host stamps <c>DeadlineFired</c> with the due time (D-238), but the guards
+    /// must stay correct for any stamp — a late fire after Modern Standby or a restart, a
+    /// replayed signal, or a future switch to the firing clock. Without the key they fall back
+    /// to the signal time (pre-key signal logs, where the two were equal by contract).
+    /// </summary>
+    public sealed class DeadlineFireTimeStampTests
+    {
+        private static readonly DateTime T0 = new DateTime(2026, 9, 9, 6, 31, 0, DateTimeKind.Utc);
+
+        private static DecisionSignal MakeSignal(
+            long ordinal,
+            DecisionSignalKind kind,
+            DateTime occurredAtUtc,
+            IReadOnlyDictionary<string, string>? payload = null) =>
+            new DecisionSignal(
+                sessionSignalOrdinal: ordinal,
+                sessionTraceOrdinal: ordinal,
+                kind: kind,
+                kindSchemaVersion: 1,
+                occurredAtUtc: occurredAtUtc,
+                sourceOrigin: "test",
+                evidence: new Evidence(EvidenceKind.Synthetic, $"t-{kind}-{ordinal}", $"synthetic {kind}"),
+                payload: payload);
+
+        /// <summary>What the host posts: name plus due time, OccurredAtUtc = firing clock.</summary>
+        private static Dictionary<string, string> FiredPayload(string deadlineName, DateTime dueAtUtc) =>
+            new Dictionary<string, string>
+            {
+                [SignalPayloadKeys.Deadline] = deadlineName,
+                [SignalPayloadKeys.DeadlineDueAtUtc] = dueAtUtc.ToString("O", CultureInfo.InvariantCulture),
+            };
+
+        // ============================================================== helper
+
+        [Fact]
+        public void DeadlineDueAtUtc_reads_the_payload_and_falls_back_to_the_signal_time()
+        {
+            var due = T0.AddMinutes(5);
+            var fired = T0.AddMinutes(9);
+
+            var withKey = MakeSignal(1, DecisionSignalKind.DeadlineFired, fired, FiredPayload(DeadlineNames.HelloSafety, due));
+            Assert.Equal(due, DecisionEngine.DeadlineDueAtUtc(withKey));
+            Assert.Equal(DateTimeKind.Utc, DecisionEngine.DeadlineDueAtUtc(withKey).Kind);
+
+            var withoutKey = MakeSignal(2, DecisionSignalKind.DeadlineFired, fired,
+                new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.HelloSafety });
+            Assert.Equal(fired, DecisionEngine.DeadlineDueAtUtc(withoutKey));
+
+            var garbage = MakeSignal(3, DecisionSignalKind.DeadlineFired, fired,
+                new Dictionary<string, string> { [SignalPayloadKeys.DeadlineDueAtUtc] = "not-a-time" });
+            Assert.Equal(fired, DecisionEngine.DeadlineDueAtUtc(garbage));
+        }
+
+        // ============================================================== Classic: standby at the Hello prompt
+
+        [Fact]
+        public void Late_HelloSafety_fire_stamps_the_resolution_and_the_grace_window_from_the_firing_clock()
+        {
+            // Session ac5660b8 shape: ESP exits, the user leaves the device at the Hello prompt, it
+            // enters Modern Standby, HelloSafety is due during the sleep and fires ~3 min late after
+            // wake. Fed with the firing clock as signal time, the reducer must stamp the Hello
+            // timeout fact, the Finalizing step and the FinalizingGrace due time from that time —
+            // the stamp policy is the host's choice (D-238), the reducer follows the signal.
+            var engine = new DecisionEngine();
+            var state = DecisionState.CreateInitial("sess-standby", "tenant", T0);
+            state = engine.Reduce(state, MakeSignal(0, DecisionSignalKind.SessionStarted, T0)).NewState;
+            state = engine.Reduce(state, MakeSignal(1, DecisionSignalKind.EspPhaseChanged, T0.AddMinutes(1),
+                new Dictionary<string, string> { [SignalPayloadKeys.EspPhase] = "AccountSetup" })).NewState;
+            state = engine.Reduce(state, MakeSignal(2, DecisionSignalKind.AccountSetupProvisioningComplete, T0.AddMinutes(2))).NewState;
+            state = engine.Reduce(state, MakeSignal(3, DecisionSignalKind.DesktopArrived, T0.AddMinutes(3))).NewState;
+
+            var espExit = T0.AddMinutes(6).AddSeconds(50.2144855);
+            state = engine.Reduce(state, MakeSignal(4, DecisionSignalKind.EspExiting, espExit)).NewState;
+            var helloSafety = Assert.Single(state.Deadlines, d => d.Name == DeadlineNames.HelloSafety);
+            Assert.Equal(espExit.AddSeconds(300), helloSafety.DueAtUtc);
+
+            // Timer fires after wake, 2m 54s past due.
+            var firedAt = helloSafety.DueAtUtc.AddSeconds(174);
+            var finalizing = engine.Reduce(state, MakeSignal(5, DecisionSignalKind.DeadlineFired, firedAt,
+                FiredPayload(DeadlineNames.HelloSafety, helloSafety.DueAtUtc)));
+
+            Assert.True(finalizing.Transition.Taken);
+            Assert.Equal(SessionStage.Finalizing, finalizing.NewState.Stage);
+            Assert.Equal("Timeout", finalizing.NewState.HelloOutcome!.Value);
+            Assert.Equal(firedAt, finalizing.NewState.HelloResolvedUtc!.Value);
+
+            var grace = Assert.Single(finalizing.NewState.Deadlines, d => d.Name == DeadlineNames.FinalizingGrace);
+            Assert.Equal(firedAt.AddSeconds(5), grace.DueAtUtc);
+
+            // The chained grace fires on time and completes; nothing carries the old due time.
+            var completed = engine.Reduce(finalizing.NewState, MakeSignal(6, DecisionSignalKind.DeadlineFired, grace.DueAtUtc,
+                FiredPayload(DeadlineNames.FinalizingGrace, grace.DueAtUtc)));
+            Assert.Equal(SessionStage.Completed, completed.NewState.Stage);
+            Assert.Equal(SessionOutcome.EnrollmentComplete, completed.NewState.Outcome);
+            Assert.Contains(completed.Effects, e =>
+                e.Kind == DecisionEffectKind.EmitEventTimelineEntry
+                && e.Parameters != null
+                && e.Parameters.TryGetValue("eventType", out var et) && et == "enrollment_complete");
+        }
+
+        // ============================================================== SelfDeploying guard C
+
+        [Fact]
+        public void SelfDeploying_guard_C_matches_the_incarnation_by_payload_due_time_not_by_firing_clock()
+        {
+            var engine = new DecisionEngine();
+            var state = DecisionState.CreateInitial("sd-late", "t", T0);
+            state = engine.Reduce(state, MakeSignal(0, DecisionSignalKind.SessionStarted, T0)).NewState;
+            state = engine.Reduce(state, MakeSignal(1, DecisionSignalKind.EspPhaseChanged, T0.AddMinutes(1),
+                new Dictionary<string, string> { [SignalPayloadKeys.EspPhase] = "DeviceSetup" })).NewState;
+            state = engine.Reduce(state, MakeSignal(2, DecisionSignalKind.DeviceSetupProvisioningComplete, T0.AddMinutes(3))).NewState;
+            var armed = Assert.Single(state.Deadlines, d => d.Name == DeadlineNames.DeviceOnlyEspDetection);
+            Assert.Equal(T0.AddMinutes(8), armed.DueAtUtc);
+
+            // A stale fire of an OLDER incarnation (due T+5) arriving late: dead-end, deadline kept.
+            var stale = engine.Reduce(state, MakeSignal(3, DecisionSignalKind.DeadlineFired, T0.AddMinutes(12),
+                FiredPayload(DeadlineNames.DeviceOnlyEspDetection, T0.AddMinutes(5))));
+            Assert.False(stale.Transition.Taken);
+            Assert.Equal("device_only_esp_detection_stale_due_at_mismatch", stale.Transition.DeadEndReason);
+            Assert.Single(stale.NewState.Deadlines, d => d.Name == DeadlineNames.DeviceOnlyEspDetection);
+
+            // The real fire, 4 min late (standby), carries the armed due time: terminal.
+            var real = engine.Reduce(stale.NewState, MakeSignal(4, DecisionSignalKind.DeadlineFired, T0.AddMinutes(12),
+                FiredPayload(DeadlineNames.DeviceOnlyEspDetection, armed.DueAtUtc)));
+            Assert.True(real.Transition.Taken);
+            Assert.Equal(SessionStage.Completed, real.NewState.Stage);
+        }
+
+        // ============================================================== RealmJoin re-arm guard
+
+        [Fact]
+        public void RealmJoin_rearm_guard_compares_the_payload_due_time_not_the_firing_clock()
+        {
+            var engine = new DecisionEngine();
+            var state = DecisionState.CreateInitial("rj-late", "t", T0);
+            state = engine.Reduce(state, MakeSignal(0, DecisionSignalKind.SessionStarted, T0)).NewState;
+            state = engine.Reduce(state, MakeSignal(1, DecisionSignalKind.EspPhaseChanged, T0.AddMinutes(1),
+                new Dictionary<string, string> { [SignalPayloadKeys.EspPhase] = "DeviceSetup" })).NewState;
+            state = engine.Reduce(state, MakeSignal(2, DecisionSignalKind.EspPhaseChanged, T0.AddMinutes(2),
+                new Dictionary<string, string> { [SignalPayloadKeys.EspPhase] = "AccountSetup" })).NewState;
+            state = engine.Reduce(state, MakeSignal(3, DecisionSignalKind.EspExiting, T0.AddMinutes(3))).NewState;
+            state = engine.Reduce(state, MakeSignal(4, DecisionSignalKind.HelloResolved, T0.AddMinutes(4),
+                new Dictionary<string, string> { [SignalPayloadKeys.HelloOutcome] = "Success" })).NewState;
+            state = engine.Reduce(state, MakeSignal(5, DecisionSignalKind.RealmJoinDetected, T0.AddMinutes(5),
+                new Dictionary<string, string> { [DecisionEngine.RealmJoinPayloadKeys.DeploymentPhase] = "100" })).NewState;
+            state = engine.Reduce(state, MakeSignal(6, DecisionSignalKind.DesktopArrived, T0.AddMinutes(6))).NewState;
+            var first = Assert.Single(state.Deadlines, d => d.Name == DeadlineNames.RealmJoinTimeout);
+
+            // Simulate the activity-based re-arm: the armed incarnation is now due later.
+            var rearmedDue = first.DueAtUtc.AddMinutes(25);
+            var rearmed = state.ToBuilder()
+                .CancelDeadline(DeadlineNames.RealmJoinTimeout)
+                .AddDeadline(new ActiveDeadline(
+                    name: DeadlineNames.RealmJoinTimeout,
+                    dueAtUtc: rearmedDue,
+                    firesSignalKind: DecisionSignalKind.DeadlineFired,
+                    firesPayload: new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.RealmJoinTimeout }))
+                .Build();
+
+            // The OLD incarnation's fire arrives late — after the re-armed due time on the clock.
+            // Only the payload due time identifies it as superseded.
+            var firedAt = rearmedDue.AddMinutes(1);
+            var stale = engine.Reduce(rearmed, MakeSignal(7, DecisionSignalKind.DeadlineFired, firedAt,
+                FiredPayload(DeadlineNames.RealmJoinTimeout, first.DueAtUtc)));
+            Assert.False(stale.Transition.Taken);
+            Assert.Equal("realmjoin_timeout_stale_superseded_by_rearm", stale.Transition.DeadEndReason);
+            Assert.Null(stale.NewState.RealmJoinFacts.Outcome);
+
+            // The re-armed incarnation's own fire, same firing clock: timeout is applied.
+            var real = engine.Reduce(stale.NewState, MakeSignal(8, DecisionSignalKind.DeadlineFired, firedAt,
+                FiredPayload(DeadlineNames.RealmJoinTimeout, rearmedDue)));
+            Assert.True(real.Transition.Taken);
+            Assert.Equal("Timeout", real.NewState.RealmJoinFacts.Outcome!.Value);
+            Assert.Equal(SessionStage.Finalizing, real.NewState.Stage);
+        }
+    }
+}

src/Agent/AutopilotMonitor.DecisionCore.Tests/RealmJoinGateTests.cs

@@ -706,7 +706,7 @@ namespace AutopilotMonitor.DecisionCore.Tests
             var deadline = Assert.Single(signalStep.NewState.Deadlines, d => d.Name == DeadlineNames.DeviceOnlyEspDetection);
             Assert.Equal(T0.AddMinutes(7), deadline.DueAtUtc);
 
-            // DeadlineFired (OccurredAtUtc = DueAtUtc per scheduler contract) → terminal.
+            // DeadlineFired at the due time (no payload due key → helper falls back to the signal time) → terminal.
             var step = engine.Reduce(signalStep.NewState, MakeSignal(3, DecisionSignalKind.DeadlineFired, T0.AddMinutes(7),
                 new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.DeviceOnlyEspDetection }));
 

src/Agent/AutopilotMonitor.DecisionCore.Tests/SelfDeployingDeadlineTerminalTests.cs

@@ -443,8 +443,9 @@ namespace AutopilotMonitor.DecisionCore.Tests
         {
             // Cancel-then-rearm race: old deadline (DueAt=T+8) fires queued; before processing,
             // DeviceSetupProvisioningComplete arrives (signal at T+10) → cancel+rearm to DueAt=T+15.
-            // The queued OLD fire (OccurredAtUtc=T+8) arrives. Guard C must dead-end WITHOUT
-            // cancelling the new deadline.
+            // The queued OLD fire arrives carrying its due time T+8 (no payload key here, so the
+            // helper falls back to the signal time). Guard C must dead-end WITHOUT cancelling the
+            // new deadline.
             var engine = new DecisionEngine();
             var state = PrimeDeviceSetup(engine, DecisionState.CreateInitial("sd-11", "t", T0));
 
@@ -467,7 +468,7 @@ namespace AutopilotMonitor.DecisionCore.Tests
                 firesPayload: new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.DeviceOnlyEspDetection }));
             state = rearmedBuilder.Build();
 
-            // OLD queued fire arrives with OccurredAtUtc=T+8 — mismatches new deadline at T+15.
+            // OLD queued fire arrives with due time T+8 — mismatches the new deadline at T+15.
             var step = engine.Reduce(state, MakeSignal(99, DecisionSignalKind.DeadlineFired, T0.AddMinutes(8),
                 new Dictionary<string, string> { [SignalPayloadKeys.Deadline] = DeadlineNames.DeviceOnlyEspDetection }));
 

src/Agent/AutopilotMonitor.DecisionCore.Tests/SerializationTests.cs

@@ -54,6 +54,37 @@ namespace AutopilotMonitor.DecisionCore.Tests
             Assert.Equal("AccountSetup", roundtripped.Payload!["phase"]);
         }
 
+        [Fact]
+        public void SignalSerializer_roundtrip_keeps_date_like_payload_strings_verbatim()
+        {
+            // The shared reader tokenizes ISO-8601 strings as dates; the string dictionaries must
+            // still come back as the round-trip text the writer produced, never culture-formatted
+            // (the DeadlineFired due time is parsed back with the "o" format on replay).
+            var due = new DateTime(2026, 4, 20, 9, 55, 0, DateTimeKind.Utc);
+            var original = new DecisionSignal(
+                sessionSignalOrdinal: 7,
+                sessionTraceOrdinal: 7,
+                kind: DecisionSignalKind.DeadlineFired,
+                kindSchemaVersion: 1,
+                occurredAtUtc: due.AddMinutes(5),
+                sourceOrigin: "DeadlineScheduler",
+                evidence: new Evidence(
+                    kind: EvidenceKind.Synthetic,
+                    identifier: "hello_safety",
+                    summary: "deadline fired",
+                    derivationInputs: new Dictionary<string, string> { ["armedAt"] = "2026-04-20T09:50:00.0000000Z" }),
+                payload: new Dictionary<string, string>
+                {
+                    ["deadline"] = "hello_safety",
+                    ["deadlineDueAtUtc"] = due.ToString("O"),
+                });
+
+            var roundtripped = SignalSerializer.Deserialize(SignalSerializer.Serialize(original));
+
+            Assert.Equal("2026-04-20T09:55:00.0000000Z", roundtripped.Payload!["deadlineDueAtUtc"]);
+            Assert.Equal("2026-04-20T09:50:00.0000000Z", roundtripped.Evidence.DerivationInputs!["armedAt"]);
+        }
+
         [Fact]
         public void SignalSerializer_Deserialize_MissingEvidence_throws()
         {

src/Agent/AutopilotMonitor.DecisionCore.Tests/State/FactStringBoundsTests.cs

@@ -11,9 +11,8 @@ namespace AutopilotMonitor.DecisionCore.Tests.State
 {
     /// <summary>
     /// Every payload-derived string that lands in <see cref="DecisionState"/> is bounded by
-    /// <see cref="FactStringBounds"/> at the reducer boundary. The server-side semantic replay
-    /// (<c>ReducerVerifier</c>) folds device-uploaded payloads through the same engine, so an
-    /// unbounded string there is a per-request memory/CPU amplifier. These tests pin that the
+    /// <see cref="FactStringBounds"/> at the reducer boundary — an unbounded string there is a
+    /// per-signal memory/CPU amplifier in every snapshot persist. These tests pin that the
     /// bound is applied BEFORE any dedupe comparison (so a forged multi-hundred-KB key neither
     /// costs a full-length compare nor lands in state) and that real-sized values pass through
     /// unchanged.

src/Backend/AutopilotMonitor.Functions.Tests/AdminConfigurationEnableIndexDualWriteTests.cs

@@ -1,34 +0,0 @@
-using AutopilotMonitor.Shared.Models;
-
-namespace AutopilotMonitor.Functions.Tests;
-
-/// <summary>
-/// Default-value + round-trip tests for <see cref="AdminConfiguration.EnableIndexDualWrite"/>
-/// (Plan §M5.d). The flag gates the index-table dual-write rollout — defaulting to false
-/// keeps pre-M5.d behaviour bit-exact and lets operators flip it on deliberately.
-/// </summary>
-public class AdminConfigurationEnableIndexDualWriteTests
-{
-    [Fact]
-    public void EnableIndexDualWrite_defaults_to_false_on_new_config()
-    {
-        var cfg = new AdminConfiguration();
-        Assert.False(cfg.EnableIndexDualWrite);
-    }
-
-    [Fact]
-    public void EnableIndexDualWrite_defaults_to_false_on_CreateDefault()
-    {
-        // CreateDefault() is called when no admin-config row exists yet — if it somehow
-        // enabled dual-write it would break the "default-off" contract immediately.
-        var cfg = AdminConfiguration.CreateDefault();
-        Assert.False(cfg.EnableIndexDualWrite);
-    }
-
-    [Fact]
-    public void EnableIndexDualWrite_true_persists_on_the_config()
-    {
-        var cfg = new AdminConfiguration { EnableIndexDualWrite = true };
-        Assert.True(cfg.EnableIndexDualWrite);
-    }
-}

src/Backend/AutopilotMonitor.Functions.Tests/AgentConfigResolverTests.cs

@@ -0,0 +1,189 @@
+using System;
+using System.Collections.Generic;
+using AutopilotMonitor.Functions.Services;
+using AutopilotMonitor.Shared.Models;
+using Xunit;
+
+namespace AutopilotMonitor.Functions.Tests;
+
+/// <summary>
+/// Pins the derivation shared by the agent channel (GET agent/config) and the Global-Admin
+/// report route (GET config/{tenantId}/effective-agent-config): every rule the Tenant Config
+/// Report used to re-implement in the web now has exactly one implementation, and these
+/// facts are its contract.
+/// </summary>
+public class AgentConfigResolverTests
+{
+    private const string TenantId = "11111111-2222-3333-4444-555555555555";
+    private static readonly DateTime Now = new(2026, 9, 6, 12, 0, 0, DateTimeKind.Utc);
+
+    private static TenantConfiguration Tenant(Action<TenantConfiguration>? mutate = null)
+    {
+        var c = new TenantConfiguration { TenantId = TenantId, DomainName = "contoso.example", UpdatedBy = "ga@operator.example" };
+        mutate?.Invoke(c);
+        return c;
+    }
+
+    private static AdminConfiguration Admin(Action<AdminConfiguration>? mutate = null)
+    {
+        var a = new AdminConfiguration();
+        mutate?.Invoke(a);
+        return a;
+    }
+
+    private static AgentConfigResponse Build(TenantConfiguration tenant, AdminConfiguration? admin = null, int agentMajor = AgentConfigResolver.CurrentAgentMajor)
+        => AgentConfigResolver.Build(tenant, admin ?? Admin(), new List<GatherRule>(), new List<ImeLogPattern>(), agentMajor, Now).Response;
+
+    [Fact]
+    public void Fresh_tenant_gets_the_agent_defaults()
+    {
+        var r = Build(Tenant());
+
+        Assert.Equal(AgentConfigResolver.ConfigVersion, r.ConfigVersion);
+        Assert.Equal(AutopilotMonitor.Shared.Constants.DefaultUploadIntervalSeconds, r.UploadIntervalSeconds);
+        Assert.Equal(10, r.UploadIntervalSeconds); // the report showed 30 for a month — pinned
+        Assert.True(r.SelfDestructOnComplete);
+        Assert.False(r.KeepLogFile);
+        Assert.True(r.EnableGeoLocation);
+        Assert.Equal(5, r.MaxAuthFailures);
+        Assert.Equal(0, r.AuthFailureTimeoutMinutes);
+        Assert.Equal("Info", r.LogLevel);
+        Assert.Equal(10, r.RebootDelaySeconds);
+        Assert.Equal(60, r.EnrollmentSummaryTimeoutSeconds);
+        Assert.Equal(120, r.EnrollmentSummaryLaunchRetrySeconds);
+        Assert.Equal(100, r.MaxBatchSize);
+        Assert.Equal("time.windows.com", r.NtpServer);
+        Assert.Equal("Off", r.DiagnosticsUploadMode);
+        Assert.False(r.DiagnosticsUploadEnabled);
+        Assert.False(r.UnrestrictedMode);
+        Assert.False(r.DeviceBlocked);
+        Assert.False(r.DeviceKillSignal);
+        Assert.Null(r.UnblockAt);
+        Assert.Null(r.MigrateToApiBaseUrl);
+
+        Assert.Equal(360, r.Collectors.AgentMaxLifetimeMinutes);
+        Assert.Equal(15, r.Collectors.CollectorIdleTimeoutMinutes);
+        Assert.Equal(10, r.Collectors.DesktopDetectorNoCandidateTimeoutMinutes);
+        Assert.Equal(new[] { 100, 1005, 1010 }, r.Collectors.ModernDeploymentHarmlessEventIds);
+
+        Assert.True(r.Analyzers.EnableLocalAdminAnalyzer);
+        Assert.Empty(r.Analyzers.LocalAdminAllowedAccounts);
+        Assert.False(r.Analyzers.EnableSoftwareInventoryAnalyzer);
+        Assert.True(r.Analyzers.EnableIntegrityBypassAnalyzer);
+        Assert.False(r.Analyzers.EnableRealmJoinWatcher);
+        Assert.False(r.Analyzers.KeepAwakeDuringUserEsp);
+        Assert.True(r.Analyzers.EnableConsoleBypassDetection);
+    }
+
+    [Theory]
+    [InlineData(null, "CustomerSas", "Off", false)]
+    [InlineData(null, "Hosted", "Off", true)]        // hosted destination needs no SAS
+    [InlineData("https://acct.blob.core.windows.net/c?sv=1", "CustomerSas", "Off", true)] // SAS enables regardless of mode
+    public void Diagnostics_upload_enabled_follows_sas_or_hosted_not_the_mode(string? sas, string destination, string mode, bool expected)
+    {
+        var r = Build(Tenant(t =>
+        {
+            t.DiagnosticsBlobSasUrl = sas!;
+            t.DiagnosticsUploadDestination = destination;
+            t.DiagnosticsUploadMode = mode;
+        }));
+        Assert.Equal(expected, r.DiagnosticsUploadEnabled);
+    }
+
+    [Theory]
+    [InlineData("free", true, true, false)]  // Community: entitlement missing
+    [InlineData("pro", false, true, false)]  // GA gate off
+    [InlineData("pro", true, false, false)]  // tenant toggle off
+    [InlineData("pro", true, true, true)]
+    public void Unrestricted_mode_needs_entitlement_and_gate_and_toggle(string planTier, bool gaGate, bool toggle, bool expected)
+    {
+        var r = Build(Tenant(t =>
+        {
+            t.PlanTier = planTier;
+            t.UnrestrictedModeEnabled = gaGate;
+            t.UnrestrictedMode = toggle;
+        }));
+        Assert.Equal(expected, r.UnrestrictedMode);
+    }
+
+    [Fact]
+    public void Operator_knobs_come_from_the_admin_configuration()
+    {
+        var admin = Admin(a =>
+        {
+            a.CollectorIdleTimeoutMinutes = 25;
+            a.DesktopDetectorNoCandidateTimeoutMinutes = 7;
+            a.AllowAgentDowngrade = true;
+            a.ModernDeploymentHarmlessEventIdsJson = "[100, 42]";
+            a.LatestAgentV2Sha256 = "zip-v2";
+            a.LatestAgentV2ExeSha256 = "exe-v2";
+        });
+
+        var r = Build(Tenant(), admin);
+
+        Assert.Equal(25, r.Collectors.CollectorIdleTimeoutMinutes);
+        Assert.Equal(7, r.Collectors.DesktopDetectorNoCandidateTimeoutMinutes);
+        Assert.True(r.AllowAgentDowngrade);
+        Assert.Equal(new[] { 100, 42 }, r.Collectors.ModernDeploymentHarmlessEventIds);
+        Assert.Equal("zip-v2", r.LatestAgentSha256);
+        Assert.Equal("exe-v2", r.LatestAgentExeSha256);
+    }
+
+    [Fact]
+    public void Legacy_major_gets_empty_hashes_the_current_major_gets_v2()
+    {
+        var admin = Admin(a => { a.LatestAgentV2Sha256 = "zip-v2"; a.LatestAgentV2ExeSha256 = "exe-v2"; });
+
+        var legacy = Build(Tenant(), admin, agentMajor: 1);
+        Assert.Equal(string.Empty, legacy.LatestAgentSha256);
+
+        var current = Build(Tenant(), admin, agentMajor: AgentConfigResolver.CurrentAgentMajor);
+        Assert.Equal("zip-v2", current.LatestAgentSha256);
+    }
+
+    [Fact]
+    public void Tenant_overrides_win_over_defaults()
+    {
+        var r = Build(Tenant(t =>
+        {
+            t.MaxBatchSize = 25;
+            t.LogLevel = "Debug";
+            t.NtpServer = "";
+            t.LocalAdminAllowedAccountsJson = "[\"Admin\",\"Helpdesk\"]";
+            t.AgentMaxLifetimeMinutes = 120;
+            t.EnableConsoleBypassDetection = false;
+        }));
+
+        Assert.Equal(25, r.MaxBatchSize);
+        Assert.Equal("Debug", r.LogLevel);
+        Assert.Equal("time.windows.com", r.NtpServer); // empty string falls back like null
+        Assert.Equal(new[] { "Admin", "Helpdesk" }, r.Analyzers.LocalAdminAllowedAccounts);
+        Assert.Equal(120, r.Collectors.AgentMaxLifetimeMinutes);
+        Assert.False(r.Analyzers.EnableConsoleBypassDetection);
+    }
+
+    [Fact]
+    public void Migration_target_is_served_when_valid_and_reported_when_rejected()
+    {
+        const string Us = "https://autopilotmonitor-api-us.azurewebsites.net";
+        var served = AgentConfigResolver.Build(Tenant(), Admin(a => a.AgentMigrateApiBaseUrl = Us),
+            new List<GatherRule>(), new List<ImeLogPattern>(), AgentConfigResolver.CurrentAgentMajor, Now);
+        Assert.Equal(Us, served.Response.MigrateToApiBaseUrl);
+        Assert.Null(served.RejectedMigrateCandidate);
+
+        var rejected = AgentConfigResolver.Build(Tenant(), Admin(a => a.AgentMigrateApiBaseUrl = "https://evil.example"),
+            new List<GatherRule>(), new List<ImeLogPattern>(), AgentConfigResolver.CurrentAgentMajor, Now);
+        Assert.Null(rejected.Response.MigrateToApiBaseUrl);
+        Assert.Equal("https://evil.example", rejected.RejectedMigrateCandidate);
+    }
+
+    [Fact]
+    public void Catalogs_pass_through_unchanged()
+    {
+        var rules = new List<GatherRule> { new() { RuleId = "GATHER-TEST-001" } };
+        var patterns = new List<ImeLogPattern> { new() { PatternId = "IME-TEST-001" } };
+        var r = AgentConfigResolver.Build(Tenant(), Admin(), rules, patterns, AgentConfigResolver.CurrentAgentMajor, Now).Response;
+        Assert.Same(rules, r.GatherRules);
+        Assert.Same(patterns, r.ImeLogPatterns);
+    }
+}

src/Backend/AutopilotMonitor.Functions.Tests/AgentEfficiencyMetricsServiceTests.cs

@@ -4,6 +4,7 @@ using AutopilotMonitor.Shared.Models;
 using AutopilotMonitor.Shared.Pagination;
 using Microsoft.Extensions.Logging.Abstractions;
 using Moq;
+using System.Threading;
 
 namespace AutopilotMonitor.Functions.Tests;
 
@@ -21,7 +22,7 @@ public class AgentEfficiencyMetricsServiceTests
     {
         var repo = new Mock<ISessionRepository>();
         repo
-            .Setup(r => r.GetAllSessionsPageAsync(It.IsAny<string?>(), It.IsAny<int?>(), It.IsAny<int>(), It.IsAny<string?>(), It.IsAny<IReadOnlyCollection<string>?>(), It.IsAny<IEnumerable<string>?>()))
+            .Setup(r => r.GetAllSessionsPageAsync(It.IsAny<string?>(), It.IsAny<int?>(), It.IsAny<int>(), It.IsAny<string?>(), It.IsAny<IReadOnlyCollection<string>?>(), It.IsAny<IEnumerable<string>?>(), It.IsAny<CancellationToken>()))
             .ReturnsAsync(new RawPage<SessionSummary>(new List<SessionSummary>(), null));
         repo
             .Setup(r => r.GetSessionEventsByTypesAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<IReadOnlyCollection<string>>(), It.IsAny<IEnumerable<string>?>(), It.IsAny<int>()))
@@ -67,7 +68,7 @@ public class AgentEfficiencyMetricsServiceTests
     private static void SetupSessions(Mock<ISessionRepository> repo, List<SessionSummary> sessions)
     {
         repo
-            .Setup(r => r.GetAllSessionsPageAsync(It.IsAny<string?>(), It.IsAny<int?>(), It.IsAny<int>(), It.IsAny<string?>(), It.IsAny<IReadOnlyCollection<string>?>(), It.IsAny<IEnumerable<string>?>()))
+            .Setup(r => r.GetAllSessionsPageAsync(It.IsAny<string?>(), It.IsAny<int?>(), It.IsAny<int>(), It.IsAny<string?>(), It.IsAny<IReadOnlyCollection<string>?>(), It.IsAny<IEnumerable<string>?>(), It.IsAny<CancellationToken>()))
             .ReturnsAsync(new RawPage<SessionSummary>(sessions, null));
     }
 
@@ -201,8 +202,8 @@ public class AgentEfficiencyMetricsServiceTests
         string? capturedTenant = null;
         IEnumerable<string>? capturedSelect = null;
         repo
-            .Setup(r => r.GetAllSessionsPageAsync(It.IsAny<string?>(), It.IsAny<int?>(), It.IsAny<int>(), It.IsAny<string?>(), It.IsAny<IReadOnlyCollection<string>?>(), It.IsAny<IEnumerable<string>?>()))
-            .Callback<string?, int?, int, string?, IReadOnlyCollection<string>?, IEnumerable<string>?>((t, _, _, _, _, sel) => { capturedTenant = t; capturedSelect = sel; })
+            .Setup(r => r.GetAllSessionsPageAsync(It.IsAny<string?>(), It.IsAny<int?>(), It.IsAny<int>(), It.IsAny<string?>(), It.IsAny<IReadOnlyCollection<string>?>(), It.IsAny<IEnumerable<string>?>(), It.IsAny<CancellationToken>()))
+            .Callback<string?, int?, int, string?, IReadOnlyCollection<string>?, IEnumerable<string>?, CancellationToken>((t, _, _, _, _, sel, _) => { capturedTenant = t; capturedSelect = sel; })
             .ReturnsAsync(new RawPage<SessionSummary>(new List<SessionSummary>(), null));
 
         var result = await service.ComputeAsync(days: 45, limit: 100, tenantId: Tenant);
@@ -220,7 +221,7 @@ public class AgentEfficiencyMetricsServiceTests
         var (service, repo) = CreateService();
         int callCount = 0;
         repo
-            .Setup(r => r.GetAllSessionsPageAsync(It.IsAny<string?>(), It.IsAny<int?>(), It.IsAny<int>(), It.IsAny<string?>(), It.IsAny<IReadOnlyCollection<string>?>(), It.IsAny<IEnumerable<string>?>()))
+            .Setup(r => r.GetAllSessionsPageAsync(It.IsAny<string?>(), It.IsAny<int?>(), It.IsAny<int>(), It.IsAny<string?>(), It.IsAny<IReadOnlyCollection<string>?>(), It.IsAny<IEnumerable<string>?>(), It.IsAny<CancellationToken>()))
             .Callback(() => callCount++)
             .ReturnsAsync(new RawPage<SessionSummary>(new List<SessionSummary>(), null));
 

src/Backend/AutopilotMonitor.Functions.Tests/AgentEndpointMigrationTests.cs

@@ -1,4 +1,4 @@
-using AutopilotMonitor.Functions.Functions.Config;
+using AutopilotMonitor.Functions.Services;
 using AutopilotMonitor.Shared.Models;
 using AutopilotMonitor.Shared.Services;
 using Xunit;
@@ -8,7 +8,7 @@ namespace AutopilotMonitor.Functions.Tests;
 /// <summary>
 /// Pins the endpoint-migration serving contract: the shared allowlist rules
 /// (<see cref="AgentEndpointMigrationRules"/>, used verbatim by the agent too) and the
-/// backend-side per-tenant resolution (<see cref="GetAgentConfigFunction.ResolveMigrateTarget"/> —
+/// backend-side per-tenant resolution (<see cref="AgentConfigResolver.ResolveMigrateTarget"/> —
 /// tenant override wins, empty override pins, invalid values are never served).
 /// </summary>
 public class AgentEndpointMigrationTests
@@ -75,7 +75,7 @@ public class AgentEndpointMigrationTests
     {
         var config = new AdminConfiguration();
 
-        Assert.Null(GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out var rejected));
+        Assert.Null(AgentConfigResolver.ResolveMigrateTarget(config, TenantA, out var rejected));
         Assert.Null(rejected);
     }
 
@@ -84,8 +84,8 @@ public class AgentEndpointMigrationTests
     {
         var config = new AdminConfiguration { AgentMigrateApiBaseUrl = UsUrl };
 
-        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out _));
-        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantB, out _));
+        Assert.Equal(UsUrl, AgentConfigResolver.ResolveMigrateTarget(config, TenantA, out _));
+        Assert.Equal(UsUrl, AgentConfigResolver.ResolveMigrateTarget(config, TenantB, out _));
     }
 
     [Fact]
@@ -97,8 +97,8 @@ public class AgentEndpointMigrationTests
             AgentMigrateTenantOverridesJson = $"{{\"{TenantA}\": \"{EuUrl}\"}}"
         };
 
-        Assert.Equal(EuUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out _));
-        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantB, out _));
+        Assert.Equal(EuUrl, AgentConfigResolver.ResolveMigrateTarget(config, TenantA, out _));
+        Assert.Equal(UsUrl, AgentConfigResolver.ResolveMigrateTarget(config, TenantB, out _));
     }
 
     [Fact]
@@ -110,9 +110,9 @@ public class AgentEndpointMigrationTests
             AgentMigrateTenantOverridesJson = $"{{\"{TenantA}\": \"\"}}"
         };
 
-        Assert.Null(GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out var rejected));
+        Assert.Null(AgentConfigResolver.ResolveMigrateTarget(config, TenantA, out var rejected));
         Assert.Null(rejected); // pinned, not rejected
-        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantB, out _));
+        Assert.Equal(UsUrl, AgentConfigResolver.ResolveMigrateTarget(config, TenantB, out _));
     }
 
     [Fact]
@@ -123,7 +123,7 @@ public class AgentEndpointMigrationTests
             AgentMigrateTenantOverridesJson = $"{{\"{TenantA.ToUpperInvariant()}\": \"{UsUrl}\"}}"
         };
 
-        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out _));
+        Assert.Equal(UsUrl, AgentConfigResolver.ResolveMigrateTarget(config, TenantA, out _));
     }
 
     [Fact]
@@ -131,7 +131,7 @@ public class AgentEndpointMigrationTests
     {
         var config = new AdminConfiguration { AgentMigrateApiBaseUrl = "https://attacker.example.com" };
 
-        Assert.Null(GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out var rejected));
+        Assert.Null(AgentConfigResolver.ResolveMigrateTarget(config, TenantA, out var rejected));
         Assert.Equal("https://attacker.example.com", rejected);
     }
 
@@ -144,7 +144,7 @@ public class AgentEndpointMigrationTests
             AgentMigrateTenantOverridesJson = "{not json"
         };
 
-        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out _));
+        Assert.Equal(UsUrl, AgentConfigResolver.ResolveMigrateTarget(config, TenantA, out _));
     }
 
     [Fact]
@@ -155,6 +155,6 @@ public class AgentEndpointMigrationTests
             AgentMigrateApiBaseUrl = "https://AutopilotMonitor-API-US.azurewebsites.net/"
         };
 
-        Assert.Equal(UsUrl, GetAgentConfigFunction.ResolveMigrateTarget(config, TenantA, out _));
+        Assert.Equal(UsUrl, AgentConfigResolver.ResolveMigrateTarget(config, TenantA, out _));
     }
 }